Description
In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header.
This issue was fixed in version 2.3.0
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenIDC | liboauth2 | < 2.3.0 | 2.3.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | liboauth2 | 2.3.0-1 | — |
| Debian 13 | liboauth2 | No fix yet | — |
| Debian 12 | liboauth2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | liboauth2 | No fix yet | — |
| Ubuntu 26.04 LTS | liboauth2 | No fix yet | — |
| Ubuntu 25.10 | liboauth2 | No fix yet | — |
| Ubuntu 24.04 LTS | liboauth2 | No fix yet | — |
| Ubuntu 22.04 LTS | liboauth2 | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | liboauth | No fix yet | — |
References
- https://cert.pl/en/posts/2026/07/CVE-2026-54430 third-party-advisory
- https://github.com/OpenIDC/liboauth2 product
- https://github.com/OpenIDC/liboauth2/commit/c0b57152ed6a0af33aeb04a60bd7f5bff5ab8800 issue-tracking