CVE-2026-59096

Name of the Vulnerable Software and Affected Versions Dapr (affected versions not specified)

Description Dapr Sentry's OIDC discovery endpoint /.well-known/openid-configuration derives the issuer and jwks uri from the request Host. When no allowed-hosts list is configured, the system honors an attacker-controlled X-Forwarded-Host header without validation and serves the document with a one-hour public cache lifetime. A remote unauthenticated attacker can poison the discovery document, leading relying parties performing dynamic discovery to fetch the JSON Web Key Set (JWKS) from an attacker-controlled server. This allows attacker-signed JSON Web Tokens (JWTs) to be accepted. This issue occurs when the OIDC server is enabled without a configured jwt-issuer or oidc-allowed-hosts.

Recommendations Configure the jwt-issuer or oidc-allowed-hosts to prevent the OIDC discovery endpoint from honoring unvalidated host headers.