Description
liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT
header. If signer matches the configured ARN, kid is appended to
alb_base_url without URL encoding or path sanitization, and the HTTP GET
is issued before signature verification. This allows an attacker to force
the server to send a GET request to an attacker-chosen internal path.
This issue was fixed in version 2.3.0
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenIDC | liboauth2 | < 2.3.0 | 2.3.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | liboauth2 | 2.3.0-1 | — |
| Debian 13 | liboauth2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | liboauth2 | No fix yet | — |
| Ubuntu 26.04 LTS | liboauth2 | No fix yet | — |
| Ubuntu 25.10 | liboauth2 | No fix yet | — |
| Ubuntu 24.04 LTS | liboauth2 | No fix yet | — |
| Ubuntu 22.04 LTS | liboauth2 | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | liboauth | No fix yet | — |
References
- https://cert.pl/en/posts/2026/07/CVE-2026-54430 third-party-advisory
- https://github.com/OpenIDC/liboauth2 product
- https://github.com/OpenIDC/liboauth2/commit/347507ac5b51f48c2933bbe49b2ee07c2af4712b issue-tracking