CVE-2026-54430

Name of the Vulnerable Software and Affected Versions liboauth2 versions prior to 2.3.0

Description An issue exists in the oauth2 jose jwks aws alb resolve() function where the AWS ALB verifier processes the signer and kid values from an unverified JWT header. When the signer matches the configured ARN, the kid is appended to the alb base url without URL encoding or path sanitization. Because the HTTP GET request is issued before the signature is verified, a remote attacker can trigger a Server-Side Request Forgery (SSRF), forcing the server to send a GET request to an internal path of the attacker's choosing.

Recommendations Update to version 2.3.0.