Skip to content
OpenAdvisories

Vendor

OpenIDC

10 known vulnerabilities.

Products

mod_auth_openidc 4 cjose 3 liboauth2 2 pyoidc 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.1
    CVE-2026-54431

    Improper Data Validation in liboauth2

    In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function retur…

    OpenIDC liboauth2 liboauth2 liboauth2 Debian Ubuntu
  • Medium 5.1
    CVE-2026-54430

    Server-Site Request Forgery in liboauth2

    liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to alb_base_url without…

    OpenIDC liboauth2 liboauth2 liboauth2 Debian Ubuntu
  • Medium 6.8
    CVE-2020-26244

    Cryptographic issues in Python oic

    Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked …

    OpenIDC pyoidc oic PyPI