Server-Side Request Forgery in liboauth2 by OpenIDC
CVE-2026-54430

5.1MEDIUM

Key Information:

Vendor

Openidc

Status
Liboauth2
Vendor
CVE Published:
2 July 2026

What is CVE-2026-54430?

The liboauth2 library is susceptible to a Server-Side Request Forgery (SSRF) vulnerability in the oauth2_jose_jwks_aws_alb_resolve() function. This flaw occurs when the AWS Application Load Balancer verifier reads the signer and kid values from an unverified JWT header. If the signer corresponds to the configured Amazon Resource Name (ARN), the kid is added to the alb_base_url without proper URL encoding or path sanitization. Consequently, an attacker can manipulate the server to perform an HTTP GET request to a path of their choice within the internal network, potentially leading to unauthorized access to sensitive information.

Affected Version(s)

liboauth2 0 < 2.3.0

References

https://cert.pl/en/posts/2026/07/CVE-2026-54430
third-party-advisory
https://github.com/OpenIDC/liboauth2
product
https://github.com/OpenIDC/liboauth2/commit/347507ac5b51f...
issue-tracking

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.