4.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41164

CVE-2026-41164: nuts-node: JWT type confusion in v1 access token introspection allows VP replay as access token

nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (/auth/v1/introspect_access_token) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active: true introspection response. This vulnerability is fixed in 6.2.3 and 5.4.31.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41164

CVE-2026-41164:

4.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/nuts-foundation/nuts-node	go	<= 1.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the IntrospectAccessToken function, which is responsible for validating access tokens. Before the patch, this function did not perform sufficient validation on the incoming JWT, allowing a Verifiable Presentation (VP) to be replayed as an access token. This is a classic type confusion vulnerability where the system cannot distinguish between two different types of JWTs.

The patch addresses this by adding three key validation checks to IntrospectAccessToken:

typ header validation: It now requires the typ header to be at+jwt, ensuring that only access tokens are processed.
Required claims validation: It checks for the presence of iss, sub, and service claims, which are essential for access control.
Issuer-to-key binding: It verifies that the iss claim matches the DID extracted from the kid header, preventing an attacker from using a token with a mismatched issuer and signing key.

The buildAccessToken function was also updated to set the typ header to at+jwt when creating new access tokens. This ensures that newly issued tokens are compliant with the new validation rules.

Vulnerable functions

authzServer.IntrospectAccessToken

auth/services/oauth/authz_server.go

This function was vulnerable because it did not properly validate the incoming JWT. It allowed a Verifiable Presentation (VP) to be replayed as an access token, leading to a type confusion vulnerability. An attacker could present a VP JWT to the introspection endpoint and receive an `active: true` response, potentially allowing unauthorized access to resources.

authzServer.buildAccessToken

auth/services/oauth/authz_server.go

This function was part of the vulnerability because it did not set a specific `typ` header for access tokens, making them indistinguishable from other JWT types like Verifiable Presentations. The fix ensures that access tokens are explicitly typed as `at+jwt`, allowing the `IntrospectAccessToken` function to differentiate them from other JWTs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.