The Janssen Project is an open-source identity and access management platform. Prior to 2.0.0, the jans-auth-server accepted unsigned JSON Web Encryption (JWE) request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload() returns null, and AuthzRequestService.processRequestObject does not reject the unrecognized RSA-OAEP algorithm when forceSignedRequestObject=true. This flaw allows unsigned requests to be processed, and the issue is addressed in version 2.0.0. The weakness is identified as CWE‑347.

The JanssenProject jans identity and access management platform is affected on all releases prior to version 2.0.0. No specific patch level is listed; the issue remains until a new release that includes the described fix is deployed.

The CVSS score is 5.3, indicating a moderate level of severity. EPSS score < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting limited evidence of widespread exploitation. The likely attack vector is via crafted HTTP requests targeting the jans-auth-server; exploitation requires the target to accept unsigned JWE request objects.