https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T05:43:26.316658+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-332196 EUVD-2026-332196 2026-10-05T05:43:26.321247+00:00 EUVD-2026-332196 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54431 fkie_cve-2026-54431 2026-10-05T05:43:26.321284+00:00

In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header.

This issue was fixed in version 2.3.0

 https://cve.radiocsirt.org/vuln/ghsa-3pf6-g4x4-jm46 GHSA-3pf6-g4x4-jm46 2026-10-05T05:43:26.321320+00:00

In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header.

This issue was fixed in version 2.3.0

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54431 UBUNTU-CVE-2026-54431 2026-10-05T05:43:26.321339+00:00

Affected: Ubuntu:22.04:LTS: liboauth2, Ubuntu:24.04:LTS: liboauth2, Ubuntu:25.10: liboauth2, Ubuntu:26.04:LTS: liboauth2

In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header. This issue was fixed in version 2.3.0