{
  "number": 10070,
  "title": "Updates to OAuth 2.0 JSON Web Token (JWT) Client Authentication and Assertion-Based Authorization Grants",
  "authors": [
    "M.B. Jones",
    "B. Campbell",
    "C. Mortimore",
    "F. Skokan"
  ],
  "published": "2026-11",
  "status": "Proposed Standard",
  "stream": "IETF",
  "area": "sec",
  "working_group": "oauth",
  "pages": 16,
  "formats": [
    "HTML",
    "TXT",
    "PDF",
    "XML"
  ],
  "abstract": "This document updates RFCs 7521, 7522, 7523, and 9126 with respect to the treatment of audience values in OAuth 2.0 Client Assertion Authentication and Assertion-based Authorization Grants to address a security vulnerability identified in the previous requirements for those audience values in multiple OAuth 2.0 specifications.",
  "keywords": [
    "OAuth",
    "JWT",
    "Assertion",
    "Token",
    "Security Token"
  ],
  "draft": "draft-ietf-oauth-rfc7523bis-11",
  "doi": "10.17487/RFC10070",
  "updates": [
    "RFC7521",
    "RFC7522",
    "RFC7523",
    "RFC9126"
  ],
  "urls": {
    "html": "https://rfc.dk/rfc10070/",
    "text": "https://rfc.dk/rfc10070.txt",
    "rfc_editor": "https://www.rfc-editor.org/rfc/rfc10070",
    "datatracker": "https://datatracker.ietf.org/doc/rfc10070/"
  },
  "text_modified": "2026-11-07T20:51:14.444118976Z"
}