CVE-2026-41164: Nuts-Foundation Nuts-Node

Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days.

nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (/auth/v1/introspect_access_token) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active: true introspection response. This vulnerability is fixed in 6.2.3 and 5.4.31.

Affected products

• Nuts-Foundation Nuts-Node: from 6.0.0-alpha.1, before 6.2.3 (fixed in 6.2.3); before 5.4.31 (fixed in 5.4.31)

Published 2026-05-26. Last modified 2026-07-24.