nuts-foundation vulnerabilities and threats

CVE-2026-41164 is a medium severity vulnerability in nuts-foundation's nuts-node prior to versions 6.2.3 and 5.4.31. The v1 access token introspection endpoint incorrectly accepts any JWT signed by a key on the node without properly validating the JWT type, issuer-to-key binding, or required claims. This flaw allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active introspection response. The issue is fixed in versions 6.2.3 and 5.