CVE-2026-45795 Details
Description
The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload() returns null, and AuthzRequestService.processRequestObject() does not reject the unrecognized RSA-OAEP algorithm when forceSignedRequestObject=true. This issue is fixed in version 2.0.0.
A vulnerability exists in the Janssen Project Auth Server in versions prior to 2.0.0, allowing unsigned JWE (JSON Web Encryption) request objects to be accepted without proper signature verification. This issue arises because the JwtAuthorizationRequest class skips inner signature validation when the JWE payload is not a signed JWT. Additionally, the AuthzRequestService does not reject unrecognized algorithms, such as RSA-OAEP, when the forceSignedRequestObject option is enabled. As a result, an attacker can bypass security controls and inject arbitrary OIDC authorization parameters.
Users can upgrade to Janssen Project Auth Server version 2.0.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/JanssenProject/jans/security/advisories/GHSA-r3gj-4pj2-9j3j | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/JanssenProject/jans/commit/0cdd214870ee30eb2186261f21c85b9e9fc63b5c | [email protected] | Source CodeVendor |
| https://github.com/JanssenProject/jans/pull/13438 | [email protected] | Source CodeVendor |
| https://github.com/JanssenProject/jans/releases/tag/v2.0.0 | [email protected] | Release NotesVendor |
| https://github.com/JanssenProject/jans/security/advisories/GHSA-r3gj-4pj2-9j3j | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Janssen Project Janssen Auth Server | <= 1.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |