CVE-2026-54430: liboauth2 SSRF Vulnerability

CVE-2026-54430 Overview

CVE-2026-54430 is a Server-Side Request Forgery (SSRF) vulnerability in the liboauth2 library, specifically within the oauth2_jose_jwks_aws_alb_resolve() function. The AWS Application Load Balancer (ALB) verifier reads both the signer and kid fields from the unverified JWT header. When the signer matches the configured Amazon Resource Name (ARN), the kid value is appended to alb_base_url without URL encoding or path sanitization. The HTTP GET request is issued before signature verification, allowing an attacker to coerce the server into fetching an attacker-chosen internal path. The issue is tracked under [CWE-918] and was fixed in version 2.3.0.

Critical Impact
An unauthenticated attacker can force the server hosting liboauth2 to issue outbound HTTP GET requests to arbitrary internal paths, enabling reconnaissance of internal services.

Affected Products

OpenIDC liboauth2 versions prior to 2.3.0
Applications embedding liboauth2 with AWS ALB JWT verification enabled
Downstream modules relying on oauth2_jose_jwks_aws_alb_resolve()

Discovery Timeline

2026-07-02 - CVE-2026-54430 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database
Credited researchers: Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team

Technical Details for CVE-2026-54430

Vulnerability Analysis

The flaw resides in the AWS ALB JSON Web Key Set (JWKS) resolution routine oauth2_jose_jwks_aws_alb_resolve(). The function parses an incoming JSON Web Token (JWT) header and extracts two fields controlled by the client: signer and kid (Key ID). After confirming that signer matches the configured ARN, the routine concatenates the raw kid value to alb_base_url to build the JWKS retrieval URL.

Because the kid value is neither URL-encoded nor sanitized for path traversal sequences, an attacker can inject characters such as /, .., or query separators. The library then issues the outbound HTTP GET request before performing any cryptographic signature verification of the JWT. This ordering allows unauthenticated requests to trigger the SSRF primitive.

Root Cause

The root cause is missing input sanitization on the untrusted kid header field prior to URL construction, combined with performing the outbound HTTP fetch before signature verification. This violates the principle of validating cryptographic material before acting on untrusted claims.

Attack Vector

An attacker submits a crafted JWT whose header contains a matching signer ARN and a malicious kid value encoding a path traversal or absolute path. The server appends this value to alb_base_url and issues a GET request to the resulting URL, potentially reaching internal metadata endpoints, administrative interfaces, or other restricted resources reachable from the server.

text

# Patch entry from ChangeLog documenting the fix
+06/02/2026
+- jose: URL-encode the JWT "kid" before constructing the AWS ALB JWKs URL to
+  prevent path traversal/injection (SSRF) into the outbound key request (CWE-918)
+  thanks Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team

Source: GitHub Commit 347507ac

Detection Methods for CVE-2026-54430

Indicators of Compromise

Outbound HTTP GET requests from the liboauth2-hosting process to unexpected internal hostnames or IP ranges.
JWT headers containing kid values with /, .., %2F, or query string characters.
Access log entries on internal services showing GETs originating from the OAuth2 relying party host.

Detection Strategies

Inspect application logs for JWT kid values that deviate from expected key identifier formats such as UUIDs or opaque base64 strings.
Correlate inbound JWT authentication attempts with subsequent outbound HTTP requests from the same process.
Alert on requests to cloud metadata endpoints (for example, 169.254.169.254) or private network ranges from services that normally only egress to public JWKS endpoints.

Monitoring Recommendations

Enable verbose logging in liboauth2 to capture constructed JWKS URLs prior to fetch.
Route service egress traffic through an outbound proxy that restricts destinations to an allowlist of trusted JWKS hosts.
Track version inventory of liboauth2 across build pipelines to confirm patched releases are deployed.

How to Mitigate CVE-2026-54430

Immediate Actions Required

Upgrade liboauth2 to version 2.3.0 or later on all systems that consume AWS ALB-signed JWTs.
Audit configurations to identify services using oauth2_jose_jwks_aws_alb_resolve() and prioritize their remediation.
Restrict egress from OAuth2 relying party hosts to the specific AWS ALB JWKS endpoints required for verification.

Patch Information

The upstream fix is documented in GitHub Commit 347507ac and released in liboauth2 version 2.3.0. The patch URL-encodes the JWT kid value before constructing the AWS ALB JWKS URL, blocking path traversal and injection into the outbound key request. Additional context is available in the CERT Security Advisory and the GitHub Repository for liboauth2.

Workarounds

Deploy an egress firewall or proxy that limits outbound HTTP GETs from the service to the specific AWS ALB JWKS domain and path prefix.
Add a reverse proxy in front of the OAuth2 endpoint that rejects JWTs whose header kid contains URL reserved characters or path separators.
Disable the AWS ALB verifier code path if it is not required by the deployment.

bash

# Example egress restriction using iptables to permit only the expected ALB JWKS host
iptables -A OUTPUT -p tcp -d public-keys.auth.elb.<region>.amazonaws.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT