JWT Auth returns HTTP 500 when the token's aud claim is an array and an Audiences constraint is configured #7462

Product

Platform/Access controls/Other

Describe the bug

A Machine Identity with JWT Auth and an Audiences bound claim returns a
500 when the presented token's aud is a JSON array rather than a scalar string —
even when the configured audience is a member of that array:

POST /api/v1/auth/jwt-auth/login
HTTP 500  { "statusCode": 500, "error": "Internal Server Error", "message": "Something went wrong" }

Removing the Audiences constraint lets the same token authenticate (200), which
isolates the failure to the audience comparison. Array-valued aud is spec-legal
(RFC 7519 §4.1.3) and is the guaranteed shape of every Kubernetes ServiceAccount
token, so this blocks any Kubernetes workload using JWT Auth.

To Reproduce

1. Create a Machine Identity with JWT Auth / JWKS, setting Audiences to
   infisical and Subject to system:serviceaccount:<ns>:<sa>.
2. Mint a token whose aud array contains that audience:

   kubectl create token <sa> -n <ns> --audience infisical --duration 1h
   

   → payload contains "aud": ["infisical"].
3. Attempt login:

   curl -sS -X POST https://eu.infisical.com/api/v1/auth/jwt-auth/login \
     -H 'Content-Type: application/json' \
     -d '{"identityId":"<id>","jwt":"<token>"}'
   

   → HTTP 500 "Something went wrong".

Removing the Audiences constraint and retrying the same token → 200.

Expected behavior

The audience check should treat aud as a set: accept when the configured audience
is a member, return 401 when it isn't. It should never throw a 500 on a
spec-legal claim shape, regardless of comparison semantics.

Screenshots

No response

Deployment Type

Infisical Cloud

Additional context

Environment

• Infisical Cloud, EU region (eu.infisical.com), observed 2026-07-28
• Machine Identity → JWT Auth, JWKS configuration
• Token issuer: Kubernetes ServiceAccount OIDC issuer (RS256), JWKS served publicly
• Reproduced server-side with curl; originally hit via External Secrets Operator

Specification references

• RFC 7519 §4.1.3 — aud is an array of case-sensitive strings, with a single
  string permitted as shorthand for the one-audience case; the array is the general
  form. https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3
• Kubernetes TokenRequest — spec.audiences is a list, so issued tokens always
  serialize aud as an array.
  https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/

Request ID

• req-i5q6h5ZJs2EcXP

Workaround

Drop the Audiences constraint and rely on Issuer + Subject bound claims (loses
audience scoping).