The vulnerability arises because the v1 access token introspection endpoint accepts any JWT signed by a key available on the node, without validating the JWT type, issuer‑to‑key binding, or required claims. This logic flaw allows an attacker to replay a Verifiable Presentation (VP) JWT as if it were an access token, causing the introspection API to return an active:true response and effectively bypassing authentication checks. The result is an unauthorized use of the token, potentially granting the attacker access to services that require a valid access token.

The issue affects the nuts-node implementation of the Nuts specification, specifically versions prior to 6.2.3 and 5.4.31. The vulnerable endpoint is /auth/v1/introspect_access_token, which is part of the public API for token introspection.

The CVSS score of 4.4 indicates moderate severity, and no EPSS data is available, while the vulnerability is not listed in CISA KEV. Exploitation is likely remote, requiring only the possession or crafting of a VP JWT signed by a key recognized by the node. Once such a token is replayed, the introspection service will report it as valid, enabling the attacker to gain unauthorized access. The lack of current exploitation reports and the moderate CVSS suggest a moderate but non‑negligible risk for deployments that rely on this endpoint.