https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T23:10:26.874405+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-332197 EUVD-2026-332197 2026-10-04T23:10:26.940799+00:00 EUVD-2026-332197 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54430 fkie_cve-2026-54430 2026-10-04T23:10:26.940838+00:00

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to alb_base_url without URL encoding or path sanitization, and the HTTP GET is issued before signature verification. This allows an attacker to force the server to send a GET request to an attacker-chosen internal path.

This issue was fixed in version 2.3.0

 https://cve.radiocsirt.org/vuln/ghsa-qrcr-3862-9f4c GHSA-qrcr-3862-9f4c 2026-10-04T23:10:26.940875+00:00

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to alb_base_url without URL encoding or path sanitization, and the HTTP GET is issued before signature verification. This allows an attacker to force the server to send a GET request to an attacker-chosen internal path.

This issue was fixed in version 2.3.0

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54430 UBUNTU-CVE-2026-54430 2026-10-04T23:10:26.940895+00:00

Affected: Ubuntu:22.04:LTS: liboauth2, Ubuntu:24.04:LTS: liboauth2, Ubuntu:25.10: liboauth2, Ubuntu:26.04:LTS: liboauth2

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to alb_base_url without URL encoding or path sanitization, and the HTTP GET is issued before signature verification. This allows an attacker to force the server to send a GET request to an attacker-chosen internal path. This issue was fixed in version 2.3.0