# liboauth2 SSRF and DPoP flaws fixed

Published: 2026-07-02 · Severity: high
Canonical: https://vorant.io/reports/06b84342-89d1-547c-97cb-2d0b47c2d8a7/liboauth2-ssrf-and-dpop-flaws-fixed

> Two vulnerabilities in OpenIDC liboauth2 allow SSRF attacks via AWS ALB verifier path traversal and acceptance of malformed DPoP proofs containing private keys.

CERT Polska coordinated disclosure of two vulnerabilities in OpenIDC liboauth2 software. CVE-2026-54430 is a Server-Side Request Forgery flaw in the oauth2_jose_jwks_aws_alb_resolve() function where the AWS ALB verifier reads signer and kid parameters from unverified JWT headers. When the signer matches a configured ARN, the kid value is appended to alb_base_url without URL encoding or path sanitization before signature verification, allowing attackers to force the server to send GET requests to arbitrary internal paths.

CVE-2026-54431 affects the Demonstrating Proof-of-Possession (DPoP) verifier, which incorrectly accepts proofs whose JSON Web Key header contains private key material. RFC 9449 section 4.3 step 7 mandates rejection of such proofs, but the oauth2_token_verify() function returns success for malformed DPoP proofs embedding private Elliptic Curve keys in the header. Both issues were addressed in liboauth2 version 2.3.0.

The vulnerabilities were responsibly reported by Michał Majchrowicz and Marcin Wyczechowski from AFINE Team. Organizations using liboauth2 should upgrade to version 2.3.0 or later to remediate these flaws.

## Mentioned in this report

- Vulnerabilities: CVE-2026-54430, CVE-2026-54431

## Detection guidance (public sample)

### Potential AWS ALB JWT SSRF via Malicious kid Header in liboauth2

ATT&CK: T1190

Detects HTTP requests carrying a JWT Authorization header whose unverified 'kid' parameter contains path traversal or absolute URL sequences, consistent with CVE-2026-54430 SSRF exploitation of oauth2_jose_jwks_aws_alb_resolve(). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious JWT kid Parameter Indicating SSRF Attempt Against AWS ALB Verifier
id: f1f12114-c05c-5f2a-85bc-107d4b096eeb
status: experimental
logsource:
  category: webserver
  product: apache
description: 'Detects inbound HTTP requests containing an Authorization Bearer JWT
  whose header ''kid'' value contains path traversal sequences or a scheme prefix
  (http:// or https://), which liboauth2''s oauth2_jose_jwks_aws_alb_resolve() appends
  unsanitized to an internal base URL, enabling SSRF (CVE-2026-54430).

  '
detection:
  selection:
    cs-authorization|contains: 'Bearer '
  suspicious_kid:
    cs-authorization|contains:
    - '"kid":"../'
    - '"kid":"..%2f'
    - '"kid":"http://'
    - '"kid":"https://'
    - '"kid":"//'
  filter:
    cs-uri-stem|contains:
    - /health
    - /status
  condition: selection and suspicious_kid and not filter
falsepositives:
- Internal debugging tools that pass raw JWT structures in test headers
- Security scanners fuzzing JWT parameters during authorized pentests
level: high
tags:
- attack.t1190
- cve.2026.54430
author: Vorant
```

### Outbound Request from OAuth2/ALB Verifier Process to Link-Local Metadata Address

ATT&CK: T1190

Detects an application/web server process handling OAuth2 token verification initiating an outbound connection to the cloud instance metadata service or other link-local address, consistent with SSRF exploitation of the AWS ALB JWKS resolver in liboauth2. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Connecting to Cloud Metadata Address After Token Verification
id: f3f35418-135b-5cac-8cee-64bc8236ad55
status: experimental
logsource:
  category: network_connection
  product: windows
description: 'Detects a process typically hosting an OpenIDC/oauth2 verifier module
  (e.g. httpd, nginx, apache2) making an outbound connection to the 169.254.169.254
  metadata address or other link-local ranges shortly after handling authentication
  traffic, indicative of SSRF via the AWS ALB JWKS resolver flaw (CVE-2026-54430).
  Adapt Image list to the actual web server binary used in the environment.

  '
detection:
  selection:
    Image|endswith:
    - \httpd.exe
    - \nginx.exe
    - \apache2.exe
    DestinationIp|startswith: 169.254.
  filter:
    DestinationPort: 80
    DestinationIp: 169.254.169.254
    Initiated: 'true'
  condition: selection
falsepositives:
- Legitimate cloud-native applications intentionally querying instance metadata for
  credentials
- Container orchestration agents querying link-local metadata endpoints
level: medium
tags:
- attack.t1190
- cve.2026.54430
author: Vorant
```

### DPoP Proof JWK Header Containing Private Key Material

ATT&CK: T1190

Detects a DPoP HTTP header whose embedded JSON Web Key (jwk) claim contains a private key component ('d' parameter), which RFC 9449 mandates rejecting; liboauth2 versions before 2.3.0 incorrectly accepted such malformed proofs (CVE-2026-54431). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Malformed DPoP Proof Embedding Private EC Key Material
id: 5b9bc9f0-9d4f-5cb9-aabe-8c5f9d4b8e4e
status: experimental
logsource:
  category: webserver
  product: apache
description: 'Detects HTTP requests carrying a DPoP proof header whose JWK header
  claim includes a ''d'' (private key) parameter for an EC key, which should always
  be rejected per RFC 9449 section 4.3 step 7. Presence of this pattern in accepted
  requests indicates exploitation of CVE-2026-54431 against liboauth2 versions prior
  to 2.3.0.

  '
detection:
  selection:
    cs-dpop|contains: '"jwk":'
  malformed:
    cs-dpop|contains:
    - '"kty":"EC"'
    - '"d":"'
  condition: selection and malformed
falsepositives:
- Custom internal test harnesses that intentionally submit malformed DPoP proofs for
  regression testing
level: high
tags:
- attack.t1190
- cve.2026.54431
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-54430

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/06b84342-89d1-547c-97cb-2d0b47c2d8a7/liboauth2-ssrf-and-dpop-flaws-fixed.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup