CVE-2026-54430

EUVD-2026-41276

02.07.2026, 11:16

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT
header. If signer matches the configured ARN, kid is appended to
alb_base_url without URL encoding or path sanitization, and the HTTP GET
is issued before signature verification. This allows an attacker to force
the server to send a GET request to an attacker-chosen internal path.

This issue was fixed in version 2.3.0

SSRF

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	UNKNOWN				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 2.27%

Debian Releases

Debian Product

Codename

liboauth2

bookworm	1.4.5.4-1 fixed
bullseye	1.4.0.1-1 fixed
forky	2.3.0-1 fixed
sid	2.3.0-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

liboauth2

jammy	needs-triage
noble	needs-triage
questing	ignored
resolute	needs-triage

Common Weakness Enumeration

CWE-918 - Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

https://cert.pl/en/posts/2026/07/CVE-2026-54430

https://github.com/OpenIDC/liboauth2

https://github.com/OpenIDC/liboauth2/commit/347507ac5b51f48c2933bbe49b2ee07c2af4712b