Vulnerability · Published May 26, 2026 · Assigned by GitHub_M

CVE-2026-41164nuts-node: JWT type confusion in v1 access token introspection allows VP replay as access token

Medium 4.4

In plain English

A medium-severity insufficient verification of data authenticity in nuts-node from nuts-foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)<0.1%top 99.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (/auth/v1/introspect_access_token) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active: true introspection response. This vulnerability is fixed in 6.2.3 and 5.4.31.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/nuts-foundation/nuts-node	no fix listed	GHSA-9hmg-827w-9rhj
Go	github.com/nuts-foundation/nuts-node	no fix listed	GO-2026-5291

Affected products (as reported)

Vendor	Product	Versions
nuts-foundation	nuts-node	>= 6.0.0-alpha.1, < 6.2.3< 5.4.31

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/nuts-foundation/nuts-node/security/advisories/GHSA-9hmg-827w-9rhj x_refsource_CONFIRM