Cloudanix VulnDB

CVE-2026-45069

Medium · 6.5

Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

CVSS

6.5

EPSS

0.3%

Published

May 27, 2026

CISA due date

—

The record

`OidcTokenHandler` is Symfony's built-in access-token handler for OpenID Connect: it validates a bearer JWT and returns the authenticated user identity. It delegates claim validation to the `web-token/jwt-checker` library's `ClaimCheckerManager`. `OidcTokenHandler::verifyClaims()` registers audience (`aud`), issuer (`iss`), and expiry (`exp`) checkers, but never passes the `$mandatoryClaims` argument to `ClaimCheckerManager::check()`. That method only validates claims that are *present* in the token: a checker for an absent claim is silently skipped. A validly-signed JWT that simply **omits** `aud`, `iss`, and `exp` therefore passes verification.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities