Known vulnerabilities in OpenIDC liboauth2
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-54431 | In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header… | 5.1 Medium | Jul 2, 2026 |
| CVE-2026-54430 | liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB… | 5.1 Medium | Jul 2, 2026 |