diff --git a/extension/eclipse-soteria/pom.xml b/extension/eclipse-soteria/pom.xml
index 0612315d3..7573450d7 100644
--- a/extension/eclipse-soteria/pom.xml
+++ b/extension/eclipse-soteria/pom.xml
@@ -18,6 +18,12 @@
             <version>${project.version}</version>
             <scope>compile</scope>
         </dependency>
+        <!-- declared as direct dependency to fix CVE -->
+        <dependency>
+            <groupId>com.nimbusds</groupId>
+            <artifactId>nimbus-jose-jwt</artifactId>
+            <scope>compile</scope>
+        </dependency>
         <dependency>
             <groupId>jakarta.enterprise</groupId>
             <artifactId>jakarta.enterprise.cdi-api</artifactId>
diff --git a/pom.xml b/pom.xml
index 0582ac8aa..322b56175 100644
--- a/pom.xml
+++ b/pom.xml
@@ -111,6 +111,7 @@
         <microprofile-jwt-auth-api.version>2.1</microprofile-jwt-auth-api.version>
         <microprofile-jwt-auth.version>2.0.2</microprofile-jwt-auth.version>
         <mojarra.version>4.0.7</mojarra.version>
+        <nimbus-jose-jwt.version>9.40</nimbus-jose-jwt.version>
         <netty.version>4.1.112.Final</netty.version>
         <omni-mp-config.version>3.0.0</omni-mp-config.version>
         <omnibeans.version>0.3</omnibeans.version>
@@ -503,6 +504,12 @@
                 <artifactId>herring-thread</artifactId>
                 <version>${herring.version}</version>
             </dependency>
+            <!-- Nimbus Jose JWT -->
+            <dependency>
+                <groupId>com.nimbusds</groupId>
+                <artifactId>nimbus-jose-jwt</artifactId>
+                <version>${nimbus-jose-jwt.version}</version>
+            </dependency>
             <!-- Netty -->
             <dependency>
                 <groupId>io.netty</groupId>