Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-41164— nuts-node: JWT type confusion in v1 access token introspection allows VP replay as access token

Quick assessment

Affected
nuts-foundation nuts-node
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cashu NUTs是Cashu开源的一个Cashu协议规范。 Cashu NUTs 6.2.3之前版本和5.4.31之前版本存在数据伪造问题漏洞，该漏洞源于v1访问令牌内省端点接受节点上任何密钥签名的JWT，而未验证JWT类型、颁发者与密钥绑定或必需声明，可能导致可验证表示JWT被重放为访问令牌。

CVSS 4.4 · Medium EPSS 0.08% · P0

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 2

VendorProduct Version RangeStatus
nuts-foundation nuts-node >= 6.0.0-alpha.1, < 6.2.3 affected
< 5.4.31 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-41164

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nuts-node: JWT type confusion in v1 access token introspection allows VP replay as access token
Source: CVE Program / CVE List V5
Vulnerability Description
nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (/auth/v1/introspect_access_token) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active: true introspection response. This vulnerability is fixed in 6.2.3 and 5.4.31.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Vulnerability Title
Cashu NUTs 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cashu NUTs是Cashu开源的一个Cashu协议规范。 Cashu NUTs 6.2.3之前版本和5.4.31之前版本存在数据伪造问题漏洞，该漏洞源于v1访问令牌内省端点接受节点上任何密钥签名的JWT，而未验证JWT类型、颁发者与密钥绑定或必需声明，可能导致可验证表示JWT被重放为访问令牌。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
nuts-foundation nuts-node >= 6.0.0-alpha.1, < 6.2.3 -

II. Public POCs for CVE-2026-41164

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-41164

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-41164 (1)

IV. Related Vulnerabilities

Same weakness: CWE-345

V. Comments for CVE-2026-41164

No comments yet

Leave a comment