JanssenProject vulnerabilities

Products

• jans 3

Latest JanssenProject CVEs

Newest publication first

1. CVE-2026-45795 Janssen Project: JWE Request Object Signature Verification Bypass in jans-auth-server

   Published 2026-07-16

   Medium·CVSS 5.3 EPSS 0.19%

   The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload() returns null, and AuthzReques...

2. CVE-2025-54876 Jans CLI stores plaintext passwords in the local cli_cmd.log file

   Published 2025-08-05

   Medium·CVSS 6.9 EPSS 0.55%

   The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local cli_cmd.log file. This is fixed in the nightly prerelease.

3. CVE-2025-53003 Janssen Config API returns results without scope verification

   Published 2025-07-01

   High·CVSS 8.2 EPSS 0.41%

   The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verification. This has a large internal surface attack area that exposes all sorts of information from the IDP including clien...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.