CVE-2026-54430mediumCWE-918

CVE-2026-54430: medium-severity vulnerability in OpenIDC liboauth2

Server-Site Request Forgery in liboauth2

Published

Follow this CVE+ Monitor liboauth2+ Monitor liboauth2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.2%
liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to alb_base_url without URL encoding or path sanitization, and the HTTP GET is issued before signature verification. This allows an attacker to force the server to send a GET request to an attacker-chosen internal path. This issue was fixed in version 2.3.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N
Affected products
OpenIDC · liboauth2
Related CVEs — OpenIDC liboauth2

In the same product, most dangerous first.

CVE-2026-54431MEDIUMImproper Data Validation in liboauth2EPSS 0.2%