CVE-2026-54430

Description

A flaw was found in liboauth2 in the oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB JWT verifier reads the signer and kid fields from the unverified JWT header. When signer matches the configured ARN, kid is appended to the ALB base URL without path sanitization, and an HTTP GET request is issued before signature verification. An attacker who can present a crafted JWT to an endpoint using AWS ALB verification could force the server to issue GET requests to unintended internal paths, potentially disclosing limited information from internal services.

Statement

This Moderate flaw in liboauth2 allows for Server-Side Request Forgery (SSRF) when an application uses AWS ALB JWT verification. An attacker can craft a JWT to force the server to make GET requests to internal network paths, potentially exposing limited internal service information. This requires the vulnerable component to be configured with AWS ALB JWT verification.

Mitigation

Restrict network access to the application endpoint that processes
AWS ALB-signed JWTs to trusted sources only. If the AWS ALB verification
feature (oauth2_jose_jwks_aws_alb_resolve) is not required, disable it in the
liboauth2 configuration. Upgrade to liboauth2 version 2.3.0 or later to fully
resolve this vulnerability.

Understanding the Weakness (CWE)

CWE-918

Confidentiality

Technical Impact: Read Application Data

Integrity

Technical Impact: Execute Unauthorized Code or Commands

Access Control

Technical Impact: Bypass Protection Mechanism

By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.