CVE-2026-54430
Description
A flaw was found in liboauth2 in the oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB JWT verifier reads the signer and kid fields from the unverified JWT header. When signer matches the configured ARN, kid is appended to the ALB base URL without path sanitization, and an HTTP GET request is issued before signature verification. An attacker who can present a crafted JWT to an endpoint using AWS ALB verification could force the server to issue GET requests to unintended internal paths, potentially disclosing limited information from internal services.
Statement
This Moderate flaw in liboauth2 allows for Server-Side Request Forgery (SSRF) when an application uses AWS ALB JWT verification. An attacker can craft a JWT to force the server to make GET requests to internal network paths, potentially exposing limited internal service information. This requires the vulnerable component to be configured with AWS ALB JWT verification.
Mitigation
Restrict network access to the application endpoint that processes
AWS ALB-signed JWTs to trusted sources only. If the AWS ALB verification
feature (oauth2_jose_jwks_aws_alb_resolve) is not required, disable it in the
liboauth2 configuration. Upgrade to liboauth2 version 2.3.0 or later to fully
resolve this vulnerability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
