CVE-2026-54430

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54430", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-06-15T13:08:01.056Z", "datePublished": "2026-07-02T10:30:33.766Z", "dateUpdated": "2026-07-02T12:17:21.724Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-07-02T10:45:00.888Z"}, "title": "Server-Site Request Forgery in liboauth2", "datePublic": "2026-07-02T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "affected": [{"vendor": "OpenIDC", "product": "liboauth2", "repo": "https://github.com/OpenIDC/liboauth2", "modules": ["oauth2_jose_jwks_aws_alb_resolve()"], "programFiles": ["src/jose.c"], "versions": [{"status": "affected", "version": "0", "lessThan": "2.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "liboauth2 is vulnerable to Server-Side Request Forgery in\u00a0oauth2_jose_jwks_aws_alb_resolve() function.\u00a0The AWS ALB verifier reads both signer and kid from the unverified JWT\nheader. If signer matches the configured ARN, kid is appended to\nalb_base_url without URL encoding or path sanitization, and the HTTP GET\nis issued before signature verification. This allows an attacker to force\nthe server to send a GET request to an attacker-chosen internal path.\n\nThis issue was fixed in version 2.3.0", "supportingMedia": [{"type": "text/html", "base64": false, "value": "liboauth2 is vulnerable to Server-Side Request Forgery in&nbsp;oauth2_jose_jwks_aws_alb_resolve() function.&nbsp;The AWS ALB verifier reads both signer and kid from the unverified JWT\nheader. If signer matches the configured ARN, kid is appended to\nalb_base_url without URL encoding or path sanitization, and the HTTP GET\nis issued before signature verification. This allows an attacker to force\nthe server to send a GET request to an attacker-chosen internal path.<br><br>This issue was fixed in version 2.3.0"}]}], "tags": ["x_open-source"], "references": [{"url": "https://cert.pl/en/posts/2026/07/CVE-2026-54430", "tags": ["third-party-advisory"]}, {"url": "https://github.com/OpenIDC/liboauth2", "tags": ["product"]}, {"url": "https://github.com/OpenIDC/liboauth2/commit/347507ac5b51f48c2933bbe49b2ee07c2af4712b", "tags": ["issue-tracking"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Micha\u0142 Majchrowicz (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "Marcin Wyczechowski (AFINE Team)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-02T12:17:15.414798Z", "id": "CVE-2026-54430", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-02T12:17:21.724Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54430", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-02T12:17:15.414798Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-02T12:17:17.824Z"}}], "cna": {"tags": ["x_open-source"], "title": "Server-Site Request Forgery in liboauth2", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Majchrowicz (AFINE Team)"}, {"lang": "en", "type": "finder", "value": "Marcin Wyczechowski (AFINE Team)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/OpenIDC/liboauth2", "vendor": "OpenIDC", "modules": ["oauth2_jose_jwks_aws_alb_resolve()"], "product": "liboauth2", "versions": [{"status": "affected", "version": "0", "lessThan": "2.3.0", "versionType": "semver"}], "programFiles": ["src/jose.c"], "defaultStatus": "unaffected"}], "datePublic": "2026-07-02T00:00:00.000Z", "references": [{"url": "https://cert.pl/en/posts/2026/07/CVE-2026-54430", "tags": ["third-party-advisory"]}, {"url": "https://github.com/OpenIDC/liboauth2", "tags": ["product"]}, {"url": "https://github.com/OpenIDC/liboauth2/commit/347507ac5b51f48c2933bbe49b2ee07c2af4712b", "tags": ["issue-tracking"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "liboauth2 is vulnerable to Server-Side Request Forgery in\u00a0oauth2_jose_jwks_aws_alb_resolve() function.\u00a0The AWS ALB verifier reads both signer and kid from the unverified JWT\nheader. If signer matches the configured ARN, kid is appended to\nalb_base_url without URL encoding or path sanitization, and the HTTP GET\nis issued before signature verification. This allows an attacker to force\nthe server to send a GET request to an attacker-chosen internal path.\n\nThis issue was fixed in version 2.3.0", "supportingMedia": [{"type": "text/html", "value": "liboauth2 is vulnerable to Server-Side Request Forgery in&nbsp;oauth2_jose_jwks_aws_alb_resolve() function.&nbsp;The AWS ALB verifier reads both signer and kid from the unverified JWT\nheader. If signer matches the configured ARN, kid is appended to\nalb_base_url without URL encoding or path sanitization, and the HTTP GET\nis issued before signature verification. This allows an attacker to force\nthe server to send a GET request to an attacker-chosen internal path.<br><br>This issue was fixed in version 2.3.0", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-07-02T10:45:00.888Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54430", "state": "PUBLISHED", "dateUpdated": "2026-07-02T12:17:21.724Z", "dateReserved": "2026-06-15T13:08:01.056Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-07-02T10:30:33.766Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["oauth2_jose_jwks_aws_alb_resolve()"], "product": "liboauth2", "programFiles": ["src/jose.c"], "repo": "https://github.com/OpenIDC/liboauth2", "vendor": "OpenIDC", "versions": [{"lessThan": "2.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "liboauth2 is vulnerable to Server-Side Request Forgery in\u00a0oauth2_jose_jwks_aws_alb_resolve() function.\u00a0The AWS ALB verifier reads both signer and kid from the unverified JWT\nheader. If signer matches the configured ARN, kid is appended to\nalb_base_url without URL encoding or path sanitization, and the HTTP GET\nis issued before signature verification. This allows an attacker to force\nthe server to send a GET request to an attacker-chosen internal path.\n\nThis issue was fixed in version 2.3.0"}, {"lang": "es", "value": "liboauth2 es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor en la funci\u00f3n oauth2_jose_jwks_aws_alb_resolve(). El verificador de AWS ALB lee tanto el \u2019signer\u2019 como el \u2019kid\u2019 del encabezado JWT no verificado. Si el \u2019signer\u2019 coincide con el ARN configurado, el \u2019kid\u2019 se a\u00f1ade a \u2019alb_base_url\u2019 sin codificaci\u00f3n URL ni saneamiento de ruta, y la petici\u00f3n GET HTTP se emite antes de la verificaci\u00f3n de la firma. Esto permite a un atacante forzar al servidor a enviar una petici\u00f3n GET a una ruta interna elegida por el atacante.\n\nEste problema se solucion\u00f3 en la versi\u00f3n 2.3.0."}], "id": "CVE-2026-54430", "lastModified": "2026-10-25T21:10:00.770", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54430", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-02T12:17:15.414798Z", "version": "2.0.3"}}]}, "published": "2026-07-02T11:16:16.423", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2026/07/CVE-2026-54430"}, {"source": "cvd@cert.pl", "url": "https://github.com/OpenIDC/liboauth2"}, {"source": "cvd@cert.pl", "url": "https://github.com/OpenIDC/liboauth2/commit/347507ac5b51f48c2933bbe49b2ee07c2af4712b"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{"bugzilla": {"description": "liboauth2: liboauth2: Server-Side Request Forgery allows unauthorized internal network access", "id": "2496465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496465"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["liboauth2 is vulnerable to Server-Side Request Forgery in\u00a0oauth2_jose_jwks_aws_alb_resolve() function.\u00a0The AWS ALB verifier reads both signer and kid from the unverified JWT\nheader. If signer matches the configured ARN, kid is appended to\nalb_base_url without URL encoding or path sanitization, and the HTTP GET\nis issued before signature verification. This allows an attacker to force\nthe server to send a GET request to an attacker-chosen internal path.\nThis issue was fixed in version 2.3.0", "A flaw was found in liboauth2 in the oauth2_jose_jwks_aws_alb_resolve()\nfunction. The AWS ALB JWT verifier reads the signer and kid fields from\nthe unverified JWT header. When signer matches the configured ARN, kid is\nappended to the ALB base URL without path sanitization, and an HTTP GET\nrequest is issued before signature verification. An attacker who can\npresent a crafted JWT to an endpoint using AWS ALB verification could\nforce the server to issue GET requests to unintended internal paths,\npotentially disclosing limited information from internal services."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the application endpoint that processes\nAWS ALB-signed JWTs to trusted sources only. If the AWS ALB verification\nfeature (oauth2_jose_jwks_aws_alb_resolve) is not required, disable it in the\nliboauth2 configuration. Upgrade to liboauth2 version 2.3.0 or later to fully\nresolve this vulnerability."}, "name": "CVE-2026-54430", "public_date": "2026-07-02T10:30:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54430\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54430\nhttps://cert.pl/en/posts/2026/06/CVE-2026-54430\nhttps://github.com/OpenIDC/liboauth2\nhttps://github.com/OpenIDC/liboauth2/commit/347507ac5b51f48c2933bbe49b2ee07c2af4712b"], "statement": "This Moderate flaw in liboauth2 allows for Server-Side Request Forgery (SSRF) when an application uses AWS ALB JWT verification. An attacker can craft a JWT to force the server to make GET requests to internal network paths, potentially exposing limited internal service information. This requires the vulnerable component to be configured with AWS ALB JWT verification.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "liboauth2", "source": "cna", "vendor": "OpenIDC"}, "product": "liboauth2", "vendor": "openidc"}], "created": "2026-07-02T15:45:16.056030+00:00", "updated": "2026-08-01T22:00:14.522596+00:00", "vendors": ["openidc", "openidc$PRODUCT$liboauth2"]}