Skip to content
Sign in
5.1 Medium

CVE-2026-54431 In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header…

Description

In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header. This issue was fixed in version 2.3.0

Affected products and versions

Product Affected versions Fixed in
liboauth2 2.3 earliest → < 2.3.0 2.3.0

Other CVEs of liboauth2

The 2 CVEs of liboauth2 →
CVE-2026-54430 liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB… 5.1 Medium
Track this CVE