How severe is GHSA-9hmg-827w-9rhj?

GHSA-9hmg-827w-9rhj has a CVSS score of 4.4/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by GHSA-9hmg-827w-9rhj?

GHSA-9hmg-827w-9rhj affects the following packages: github.com/nuts-foundation/nuts-node (Go). Ecosystems affected: Go.

How do I fix GHSA-9hmg-827w-9rhj?

No patched version of github.com/nuts-foundation/nuts-node has shipped for GHSA-9hmg-827w-9rhj yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.

How do I detect GHSA-9hmg-827w-9rhj in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/nuts-foundation/nuts-node. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-9hmg-827w-9rhj if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-9hmg-827w-9rhj?

O3 pinpoints whether GHSA-9hmg-827w-9rhj is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-9hmg-827w-9rhj actively exploited in the wild?

No public exploit code has been indexed for GHSA-9hmg-827w-9rhj yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-9hmg-827w-9rhj published, and has it been updated?

GHSA-9hmg-827w-9rhj was published on May 5, 2026 and was last updated on June 25, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹 Go

GHSA-9hmg-827w-9rhj

MEDIUM

GHSA-9hmg-827w-9rhj is a medium-severity (CVSS 4.4) vulnerability in github.com/nuts-foundation/nuts-node. O3 Security confirms whether GHSA-9hmg-827w-9rhj is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token

Also known asCVE-2026-41164GO-2026-5291

Published

May 5, 2026

Updated

Jun 25, 2026

Affected

1 pkg

Patched

None yet

Exploits

None indexed

Real-World Exposure

1 pkg affected

🐹github.com/nuts-foundation/nuts-node

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

The v1 access token introspection endpoint (/auth/v1/introspect_access_token) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active: true introspection response.

Background

In the v1 auth flow (Nuts RFC003), access tokens are JWTs signed by the authorizer's key with:

iss = authorizer organization DID
sub = requester organization DID
service = purpose of use (e.g. "eOverdracht")
typ header = "JWT" (default, not explicitly set)

Verifiable Presentations are also JWTs with typ: "JWT" (per W3C VC Data Model 1.1). The W3C VC Data Model 2.0 changed this to vp+jwt specifically to prevent this class of confusion attack (See Securing Verifiable Credentials using JOSE and COSE 3.1.1).

Vulnerability details

The introspection endpoint performs only standard JWT checks. It does not perform the following Nuts-specific access token checks:

Validate the typ header: both ATs and VPs use "JWT"
Bind iss to the signing key: it doesn't verify that the iss claim matches the DID extracted from the kid
Validate required claims: service can be empty; vp claim is silently ignored by FromMap() which uses lenient JSON unmarshaling

Attack scenario

Prerequisites: Attacker (Org B) has received a VP JWT from the victim (Org A) during a normal access token request flow.

Org A creates a VP JWT signed with Org A's key and sends it to Org B (normal protocol flow) to request an access token
Org B presents this VP JWT to Org A's resource server as a bearer access token
Resource server calls Org A's v1 introspection endpoint
Introspection checks privateKeyStore.Exists(kid), which passes, because Org A's key is on Org A's node
JSON unmarshaling is lenient; the vp claim is silently ignored
Returns active: true with service: "", iss: "", sub: <Org A's DID>

Mitigating factors

service is empty: resource servers that strictly require a non-empty service field may reject the request at the application level
iss is empty: VP JWTs don't set iss, so resource servers checking this field would see an empty value
Short-lived VPs: VPs typically expire within minutes, narrowing the attack window
v1 is legacy: the v2 flow uses opaque access tokens and is not affected

Severity rationale

While the introspection endpoint incorrectly returns active: true for a replayed VP, we consider this not practically exploitable in the current deployment landscape. Resource servers require valid service, iss and aud values to route requests to the correct databases. A replayed VP returns empty service, empty iss, and wrong sub (Org A instead of B), making it unusable for meaningful access. The attack also requires the victim to first present a VP to the attacker through a legitimate protocol flow, and VPs are short-lived.

The severity reflects that the protection against exploitation is accidental (resource servers need service for routing, not for security) and we cannot guarantee how all resource server implementations handle the active: true response with missing fields.

The fix

Affected versions: all v5.x releases prior to v5.4.31, and all v6.x releases prior to v6.2.3. From v5.4.31 and v6.2.3 onward, the following checks have been added to IntrospectAccessToken:

iss-to-kid binding: extract the DID from the kid header and verify it matches the iss claim
Required claims validation: reject tokens where service is empty
typ header validation: requires access tokens to be of typ: "at+jwt"

Additionally, the access token creation code has been updated to use typ: "at+jwt" per RFC 9068.

Patch

Patches are available at https://github.com/nuts-foundation/nuts-node/releases/tag/v5.4.31 and https://github.com/nuts-foundation/nuts-node/releases/tag/v6.2.3.

Workaround

If users are unable to update their nuts-node, resource servers can mitigate this risk by explicitly validating the introspection response: reject responses where service is empty, where iss is empty or does not match the expected authorizer DID, or where sub does not match the expected requester DID (Org B instead of A).

Affected Packages

1 total

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/nuts-foundation/nuts-node`	all versions	No fix

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/nuts-foundation/nuts-node. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Remediation status
No patched version of github.com/nuts-foundation/nuts-node has shipped for GHSA-9hmg-827w-9rhj yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-9hmg-827w-9rhj is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-9hmg-827w-9rhj. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary The v1 access token introspection endpoint (`/auth/v1/introspect_access_token`) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an `active: true` introspection response. ## Background In the v1 auth flow ([Nuts RFC003](https://nuts-foundation.gitbook.io/v1/rfc/rfc003-oauth2-authorization)), access tokens are JWTs signed by the authorizer's key with: - `iss` = authorizer organization DID - `sub` = requester or

O3 Security · Impact-Aware SCA

Is GHSA-9hmg-827w-9rhj in your dependencies?

O3 detects GHSA-9hmg-827w-9rhj across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works