Updates to JWT Client Authentication and Assertion-Based Authorization Grants
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
RFC 10070, a November 2026 IETF Standards Track document, tightens audience-value rules in OAuth 2.0 client authentication and assertion-based grants (RFCs 7521, 7522, 7523, 9126). It follows a vulnerability disclosed by University of Stuttgart researchers.