Improper Verification in Liboauth2 Can Lead to Security Risks
CVE-2026-54431

5.1MEDIUM

Key Information:

Vendor

Openidc

Status
Liboauth2
Vendor
CVE Published:
2 July 2026

What is CVE-2026-54431?

The liboauth2 library has a vulnerability in its Demonstrating Proof-of-Possession (DPoP) verification process, whereby a malformed proof containing private key material in the JSON Web Key (JWK) header may be incorrectly accepted. According to RFC 9449 section 4.3 step 7, the verifier should reject such proofs; however, the oauth2_token_verify() function erroneously returns a success response for these malformed inputs. This flaw could potentially lead to unintended exposure of private keys, posing serious security risks. Users are advised to upgrade to version 2.3.0 or later to mitigate this issue.

Affected Version(s)

liboauth2 0 < 2.3.0

References

https://cert.pl/en/posts/2026/07/CVE-2026-54430
third-party-advisory
https://github.com/OpenIDC/liboauth2
product
https://github.com/OpenIDC/liboauth2/commit/c0b57152ed6a0...
issue-tracking

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.