CyberRota Analysis
AI-GeneratedThe Janssen Project's identity and access management platform versions prior to 2.0.0 are vulnerable due to the acceptance of unsigned JWE request objects, which can lead to unauthorized access if an attacker exploits this flaw. The impact includes potential bypass of security measures related to request validation, making it critical for organizations using this IAM solution to upgrade to version 2.0.0 or later to mitigate risks. Security teams managing identity and access systems should prioritize this update to ensure robust protection against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload() returns null, and AuthzRequestService.processRequestObject() does not reject the unrecognized RSA-OAEP algorithm when forceSignedRequestObject=true. This issue is fixed in version 2.0.0.