# JWT validation failed: issuer 'https://evil.example.com' is not in the list of trusted issuers

- **ID:** `security/oauth2-jwt-issuer-not-trusted`
- **Domain:** security
- **Category:** auth_error
- **Error Code:** `JWT_ISSUER_NOT_TRUSTED`
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

The JWT's 'iss' (issuer) claim does not match any of the configured trusted issuers, often due to a misconfiguration in the application or a token from a different identity provider being used.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Spring Security 6.1.0 | active | — | — |
| Microsoft.IdentityModel 7.0.0 | active | — | — |
| PyJWT 2.8.0 | active | — | — |
| Auth0 Java SDK 2.0.0 | active | — | — |

## Workarounds

1. **Update the application configuration to include the correct issuer. For example, in a Spring Boot application, set `spring.security.oauth2.resourceserver.jwt.issuer-uri=https://your-idp.com`.** (90% success)
   ```
   Update the application configuration to include the correct issuer. For example, in a Spring Boot application, set `spring.security.oauth2.resourceserver.jwt.issuer-uri=https://your-idp.com`.
   ```
2. **Verify the token is being obtained from the correct identity provider. Check the authorization server URL in your OAuth2 client configuration and ensure it matches the token's issuer claim.** (85% success)
   ```
   Verify the token is being obtained from the correct identity provider. Check the authorization server URL in your OAuth2 client configuration and ensure it matches the token's issuer claim.
   ```
3. **If using a multi-tenancy setup, ensure the issuer validation logic is tenant-aware and uses the correct issuer for each tenant.** (80% success)
   ```
   If using a multi-tenancy setup, ensure the issuer validation logic is tenant-aware and uses the correct issuer for each tenant.
   ```

## Dead Ends

- **** — Adding the attacker's issuer to the trusted list is a severe security vulnerability, as it would allow tokens from any source to be accepted, defeating the purpose of validation. (100% fail)
- **** — Disabling issuer validation entirely removes the check, allowing tokens from any issuer to be accepted, which is a critical security flaw. (90% fail)
- **** — Changing the token's issuer claim client-side to match the trusted list is impossible because the token is signed, and altering it will cause signature validation to fail. (80% fail)