CVE-2026-45795mediumCWE-347

CVE-2026-45795: medium-severity vulnerability in JanssenProject jans

Janssen Project: JWE Request Object Signature Verification Bypass in jans-auth-server

Published

Follow this CVE+ Monitor jans

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.2%
The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload() returns null, and AuthzRequestService.processRequestObject() does not reject the unrecognized RSA-OAEP algorithm when forceSignedRequestObject=true. This issue is fixed in version 2.0.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
JanssenProject · jans
Related CVEs — JanssenProject jans

In the same product, most dangerous first.

CVE-2025-54876MEDIUMJans CLI stores plaintext passwords in the local cli_cmd.log fileEPSS 0.5%CVE-2025-53003HIGHJanssen Config API returns results without scope verificationEPSS 0.4%