vetkit.csharp.jwt.issuer-audience-validation-disabled
JWT issuer or audience validation is disabled. Tokens issued for another application or by another tenant of the same identity provider will be accepted.
Last updated:
Suite: Security
csharp
JWT issuer or audience validation is disabled. Tokens issued for another application or by another tenant of the same identity provider will be accepted.
Category: SECURITY · Engine rule severity: INFO
How to fix it
Set ValidIssuer(s) / ValidAudience(s) and keep validation on, or supply a custom IssuerValidator for multi-tenant apps.
References
Source: packages/engine/rules/sast/csharp.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.