# JWT audience claim is not verified

Argo CD validated OIDC token signatures but not the aud claim, so tokens issued for other services were accepted and granted Argo CD privileges.

- Payout: hidden
- Severity: critical
- Program: Internet Bug Bounty
- Found by: farcaller
- Disclosed: 2023-04-16
- CVE: CVE-2023-22482
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1889161
- Library page: https://bugbountylibrary.com/r/h1%3A1889161
- Tags: area:cloud domain:cloud domain:web impact:internal-access impact:privesc kind:bounty platform:hackerone sev:critical tech:jwt tech:oidc vuln:access-control vuln:auth-bypass

**Target:** Argo CD API OIDC/JWT authentication
**Root cause:** Argo CD verifies the token signature against its configured OIDC provider but never checks the aud claim, so tokens minted for other audiences are accepted.
**Steps:**
1. Configure Argo CD with an OIDC provider that also issues tokens for other services (e.g. file storage).
2. Obtain a valid signed token whose aud targets that other service.
3. Present the token to the Argo CD API.
4. Argo CD accepts it and grants privileges from the token's groups claim.
**Exploitation:** Attacker obtains a valid token intended for a different audience from the same OIDC provider (or steals one) and replays it against Argo CD, gaining access with the token's groups-derived privileges.
**Escalation:** Blast radius of stolen tokens expands: any token from the shared IdP for another audience becomes usable against Argo CD.
**Insight:** When a target trusts a shared OIDC IdP, check whether it validates aud (and iss) — signature-only validation lets tokens minted for sibling services cross over.