https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T03:19:33.814925+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54431 CVE-2026-54431 — Improper Data Validation in liboauth2 2026-10-07T03:19:33.830240+00:00

Affected: OpenIDC liboauth2

In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header.

This issue was fixed in version 2.3.0