liboauth2 SSRF and DPoP flaws fixed
Two vulnerabilities in OpenIDC liboauth2 allow SSRF attacks via AWS ALB verifier path traversal and acceptance of malformed DPoP proofs containing private keys.
CERT Polska coordinated disclosure of two vulnerabilities in OpenIDC liboauth2 software. CVE-2026-54430 is a Server-Side Request Forgery flaw in the oauth2_jose_jwks_aws_alb_resolve() function where the AWS ALB verifier reads signer and kid parameters from unverified JWT headers. When the signer matches a configured ARN, the kid value is appended to alb_base_url without URL encoding or path sanitization before signature verification, allowing attackers to force the server to send GET requests to arbitrary internal paths.
CVE-2026-54431 affects the Demonstrating Proof-of-Possession (DPoP) verifier, which incorrectly accepts proofs whose JSON Web Key header contains private key material. RFC 9449 section 4.3 step 7 mandates rejection of such proofs, but the oauth2_token_verify() function returns success for malformed DPoP proofs embedding private Elliptic Curve keys in the header. Both issues were addressed in liboauth2 version 2.3.0.
The vulnerabilities were responsibly reported by Michał Majchrowicz and Marcin Wyczechowski from AFINE Team. Organizations using liboauth2 should upgrade to version 2.3.0 or later to remediate these flaws.
Mentioned in this report
Detection guidance
Potential AWS ALB JWT SSRF via Malicious kid Header in liboauth2
Detects HTTP requests carrying a JWT Authorization header whose unverified 'kid' parameter contains path traversal or absolute URL sequences, consistent with CVE-2026-54430 SSRF exploitation of oauth2_jose_jwks_aws_alb_resolve(). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious JWT kid Parameter Indicating SSRF Attempt Against AWS ALB Verifier
id: f1f12114-c05c-5f2a-85bc-107d4b096eeb
status: experimental
logsource:
category: webserver
product: apache
description: 'Detects inbound HTTP requests containing an Authorization Bearer JWT
whose header ''kid'' value contains path traversal sequences or a scheme prefix
(http:// or https://), which liboauth2''s oauth2_jose_jwks_aws_alb_resolve() appends
unsanitized to an internal base URL, enabling SSRF (CVE-2026-54430).
'
detection:
selection:
cs-authorization|contains: 'Bearer '
suspicious_kid:
cs-authorization|contains:
- '"kid":"../'
- '"kid":"..%2f'
- '"kid":"http://'
- '"kid":"https://'
- '"kid":"//'
filter:
cs-uri-stem|contains:
- /health
- /status
condition: selection and suspicious_kid and not filter
falsepositives:
- Internal debugging tools that pass raw JWT structures in test headers
- Security scanners fuzzing JWT parameters during authorized pentests
level: high
tags:
- attack.t1190
- cve.2026.54430
author: Vorant
Outbound Request from OAuth2/ALB Verifier Process to Link-Local Metadata Address
Detects an application/web server process handling OAuth2 token verification initiating an outbound connection to the cloud instance metadata service or other link-local address, consistent with SSRF exploitation of the AWS ALB JWKS resolver in liboauth2. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Connecting to Cloud Metadata Address After Token Verification
id: f3f35418-135b-5cac-8cee-64bc8236ad55
status: experimental
logsource:
category: network_connection
product: windows
description: 'Detects a process typically hosting an OpenIDC/oauth2 verifier module
(e.g. httpd, nginx, apache2) making an outbound connection to the 169.254.169.254
metadata address or other link-local ranges shortly after handling authentication
traffic, indicative of SSRF via the AWS ALB JWKS resolver flaw (CVE-2026-54430).
Adapt Image list to the actual web server binary used in the environment.
'
detection:
selection:
Image|endswith:
- \httpd.exe
- \nginx.exe
- \apache2.exe
DestinationIp|startswith: 169.254.
filter:
DestinationPort: 80
DestinationIp: 169.254.169.254
Initiated: 'true'
condition: selection
falsepositives:
- Legitimate cloud-native applications intentionally querying instance metadata for
credentials
- Container orchestration agents querying link-local metadata endpoints
level: medium
tags:
- attack.t1190
- cve.2026.54430
author: Vorant
DPoP Proof JWK Header Containing Private Key Material
Detects a DPoP HTTP header whose embedded JSON Web Key (jwk) claim contains a private key component ('d' parameter), which RFC 9449 mandates rejecting; liboauth2 versions before 2.3.0 incorrectly accepted such malformed proofs (CVE-2026-54431). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Malformed DPoP Proof Embedding Private EC Key Material
id: 5b9bc9f0-9d4f-5cb9-aabe-8c5f9d4b8e4e
status: experimental
logsource:
category: webserver
product: apache
description: 'Detects HTTP requests carrying a DPoP proof header whose JWK header
claim includes a ''d'' (private key) parameter for an EC key, which should always
be rejected per RFC 9449 section 4.3 step 7. Presence of this pattern in accepted
requests indicates exploitation of CVE-2026-54431 against liboauth2 versions prior
to 2.3.0.
'
detection:
selection:
cs-dpop|contains: '"jwk":'
malformed:
cs-dpop|contains:
- '"kty":"EC"'
- '"d":"'
condition: selection and malformed
falsepositives:
- Custom internal test harnesses that intentionally submit malformed DPoP proofs for
regression testing
level: high
tags:
- attack.t1190
- cve.2026.54431
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-54430
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free