Updates to OAuth 2.0 JSON Web Token (JWT) Client Authentication and Assertion-Based Authorization Grants#

Michael B. Jones (Self-Issued Consulting), Brian Campbell (Ping Identity), Chuck Mortimore (Disney), Filip Skokan (Okta) — OAuth WG, in the RFC Editor queue

• Why: Fixes a real, published vulnerability — "audience injection" attacks (Hosseyni, Küsters, Würtele, University of Stuttgart), found during security analysis of OpenID Federation — affecting private_key_jwt-style client authentication across OAuth/OIDC.
• What: Updates RFC 7521, 7522, 7523, and 9126: for client authentication, the JWT aud claim MUST be the authorization server's issuer identifier as its sole value — the token endpoint URL is no longer an acceptable audience — and the AS MUST reject JWTs that don't comply. Authorization grants may still use either issuer identifier or token endpoint URL. SAML assertions for client authentication are deprecated; a new explicit type client-authentication+jwt SHOULD be used as a compliance signal.
• How: Root cause: metadata-derived endpoint URLs used as audience values could be accepted at a different endpoint, enabling cross-endpoint token injection. The fix is deliberately asymmetric in rollout — updated clients interoperate with old servers, but not vice versa — so clients should move first; the draft documents this explicitly in its operational considerations.
• Where applicable: Every AS and client doing JWT client authentication or assertion grants. Mature: IETF last-call reviews complete, IESG consensus recorded, sitting in the RFC Editor queue. Plan the migration now.