Executive brief
The Janssen Project is an open-source identity and access management platform. In versions prior to 2.0.0, the authentication server fails to properly validate digital signatures on certain encrypted request objects. This could allow an attacker to bypass security requirements that mandate signed requests, potentially leading to unauthorized modifications of authentication parameters.
Technical details
A vulnerability exists in jans-auth-server prior to version 2.0.0 where JwtAuthorizationRequest skips inner signature validation for JSON Web Encryption (JWE) request objects. This occurs because the server fails to reject unrecognized algorithms (like RSA-OAEP) when 'forceSignedRequestObject' is enabled and incorrectly handles cases where the signed payload returns null. An attacker can exploit this by sending an encrypted but unsigned request object, bypassing mandatory signature checks. The fix, introduced in version 2.0.0, ensures that JWE objects must contain a nested signed JWT and refines the signature algorithm guard logic to reject null or 'NONE' algorithms.
Affected products
- Janssen Project jans-auth-server < 2.0.0
Timeline
- 2026-03-09: patched: Fix committed to main branch and pull request merged.
- 2026-04-22: advisory: Version 2.0.0 released.
- 2026-07-16: disclosed: CVE-2026-45795 published.