RFC 10070, an IETF standard published in November 2026, forbids an OAuth server from accepting its own token-endpoint URL as the audience of a client-authentication JWT; the audience must be the server's issuer identifier, alone. A read-only source review of five major open-source OAuth servers finds that all five still accept the token-endpoint URL. This is a conformance snapshot, not a vulnerability: the rule fixes a previously disclosed, specification-level weakness, and server-side acceptance of the endpoint URL is only one necessary condition for it.
What RFC 10070 changed
When a client authenticates to an OAuth server with a signed JWT (private_key_jwt / client_secret_jwt, and at the PAR endpoint), the JWT carries an aud (audience) claim naming the intended server. The old rules (RFC 7523 Section 3, RFC 9126 Section 2) let that audience be the server's token-endpoint URL. RFC 10070 removes that option for client authentication: the aud MUST be the server's issuer identifier as the sole value, and the token-endpoint URL MUST NOT be used.
The change is narrow and deliberate. The separate authorization-grant use of these JWTs (the JWT bearer grant) stays lenient and is out of scope here; only the code path that validates the audience of a client-authentication assertion was examined.
Why it matters: a client can verify a server's issuer identifier but not its endpoints (RFC 8414), so a malicious server can advertise a legitimate server's token-endpoint URL as its own. A client that reuses one key pair across servers and sets aud to that endpoint URL hands the malicious server an assertion it can replay to the legitimate one. This was disclosed across standards bodies (OpenID Foundation, Jan 2025) and analyzed in the literature (ePrint 2025/629); RFC 10070 is the fix.
What the five servers do
Each project's client-authentication audience validator was read at a pinned commit, against its default-branch HEAD on 9 Nov 2026. All five still accept the token-endpoint URL; four also accept a multi-valued aud. None enforces issuer-identifier-as-sole-value on the default path.
| Server | Accepts as client-auth aud | Multi-valued | Class |
|---|---|---|---|
| ory/fosite (in Hydra) | configured token URL(s) only; issuer identifier not accepted | yes | divergent |
| node-oidc-provider | issuer / token / called-endpoint URL; issuer-only under FAPI 2.0 | yes (no under FAPI 2.0) | mixed |
| Keycloak | issuer / token / introspect / PAR / CIBA URLs | rejected by default | mixed |
| Spring Authorization Server | issuer / token / introspect / revoke / PAR URLs | yes | divergent |
| Authlib | developer-configured; sole-value not enforced | yes | divergent |
Full file:line evidence, pinned commits, and the rule text are in the preprint and the code repository below.
Check it by hand
Why Low, and why it is phased
No server here is newly broken. Accepting the token-endpoint URL is one necessary condition for the disclosed cross-server replay, not the whole of it; the residual risk depends on whether key-reusing, endpoint-URL-audience clients exist against a given server. So this measures non-adoption of a published fix, not a latent bug in any one project — hence Low, and framed as conformance rather than a vulnerability.
The rule is also not new. It was disclosed in January 2025 and carried through draft-ietf-oauth-rfc7523bis, FAPI 2.0, and OIDC Core errata before RFC 10070 finalized it. Implementers have had notice and move on their own schedules: Keycloak's 26.2 upgrade notes already recommend the issuer identifier, and Spring Security issue #18226 records the maintainer deferring the change until the draft was approved. RFC 10070 itself advises updating clients before servers enforce. A snapshot like this is a measurement of that transition, not a scorecard.
Links
Cite as
Nobuo Otoi (ba-cybersecurity.com). RFC 10070 client-authentication audience rule: a five-implementation conformance snapshot. 2026. https://ba-cybersecurity.com/research/rfc10070-audience-conformance/.
@misc{otoi2026rfc10070aud,
author = {Otoi, Nobuo},
title = {RFC 10070 client-authentication audience rule: a five-implementation conformance snapshot},
year = {2026},
howpublished = {\url{https://ba-cybersecurity.com/research/rfc10070-audience-conformance/}},
note = {Code and evidence: https://github.com/otoinobuo/rfc10070-aud-conformance}
}
Measured and written 9 Nov 2026 · Read-only source review; nothing sent to maintainers · Permanent address: https://ba-cybersecurity.com/research/rfc10070-audience-conformance/