Executive brief
Nuts-node is a software component used for secure data exchange in decentralized networks. A flaw in its authentication system allows a malicious actor to reuse a temporary security credential (a Verifiable Presentation) as if it were a permanent access token. While this could theoretically allow unauthorized access to data, the practical risk is low because the replayed credentials lack the specific routing information required by most servers to process requests.
Technical details
The v1 access token introspection endpoint (/auth/v1/introspect_access_token) fails to validate the 'typ' header, bind the 'iss' claim to the signing key, or enforce required claims like 'service'. Because both Access Tokens (ATs) and Verifiable Presentations (VPs) in the v1 flow use the default 'JWT' type, an attacker who has received a VP from a victim can replay it as a bearer token. The introspection endpoint incorrectly returns 'active: true' because the signing key exists on the node and lenient JSON unmarshaling ignores the 'vp' claim. Exploitation is limited by the fact that replayed VPs result in empty 'service' and 'iss' fields, which most resource servers require for routing. Patches are available in versions 5.4.31 and 6.2.3.
Affected products
- Nuts Foundation nuts-node v5.x < v5.4.31, v6.x < v6.2.3
Timeline
- 2026-05-05: disclosed
- 2026-05-05: advisory
- 2026-05-05: patched