Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-17T13:10:22 smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-22

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it can be remotely triggered without authentication or user interaction but is limited to same-origin SSRF with read-only impact on the configured key endpoint host. Successful exploitation allows an attacker to force the application server to issue GET requests to arbitrary paths on the same origin, potentially reading non-public data exposed on that host. The vulnerability's root cause is a lack of input sanitization of the JWT kid header value before it is concatenated into the key-fetch URL in AwsAlbKeyResolver. This issue was discovered by Sandipan Roy (Red Hat). Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Exploit Intelligence Fix deferred exploit-intelligence/agent-client-rhel9 Red Hat build of Apicurio Registry 3 Fix deferred quarkus-smallrye-jwt Red Hat build of Apicurio Registry 3 Out of support scope smallrye-jwt Red Hat JBoss Enterprise Application Platform 8 Fix deferred smallrye-jwt Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred smallrye-jwt https://www.cve.org/CVERecord?id=CVE-2026-81829 https://nvd.nist.gov/vuln/detail/CVE-2026-81829