CVE-2026-54431

In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header. This issue was fixed in version 2.3.0

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/07/CVE-2026-54430
https://github.com/OpenIDC/liboauth2
https://github.com/OpenIDC/liboauth2/commit/c0b57152ed6a0af33aeb04a60bd7f5bff5ab8800

Configurations

No configuration.

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) En liboauth2, el verificador de Demostración de Prueba de Posesión (DPoP) acepta una prueba cuyo encabezado JSON Web Key (jwk) contiene material de clave privada. RFC 9449 sección 4.3 paso 7 requiere que el verificador rechace dicha prueba, pero la función oauth2_token_verify() devuelve éxito para una prueba DPoP malformada que incrusta la clave privada de Curva Elíptica (EC) en el encabezado. Este problema fue corregido en la versión 2.3.0.

Information

Published : 2026-07-02 11:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-54431

Mitre link : CVE-2026-54431

CVE.ORG link : CVE-2026-54431

JSON object : View

Products Affected

No product.

CWE

CWE-358

Improperly Implemented Security Check for Standard

{"id": "CVE-2026-54431", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54431", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-02T12:16:34.432412Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"repo": "https://github.com/OpenIDC/liboauth2", "vendor": "OpenIDC", "product": "liboauth2", "versions": [{"status": "affected", "version": "0", "lessThan": "2.3.0", "versionType": "semver"}], "programFiles": ["src/dpop.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "_oauth2_dpop_parse_and_validate()"}]}]}], "published": "2026-07-02T11:16:17.123", "references": [{"url": "https://cert.pl/en/posts/2026/07/CVE-2026-54430", "source": "cvd@cert.pl"}, {"url": "https://github.com/OpenIDC/liboauth2", "source": "cvd@cert.pl"}, {"url": "https://github.com/OpenIDC/liboauth2/commit/c0b57152ed6a0af33aeb04a60bd7f5bff5ab8800", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-358"}]}], "descriptions": [{"lang": "en", "value": "In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key\u00a0material. RFC 9449 section 4.3 step 7 requires the verifier to reject\u00a0such a proof but\u00a0oauth2_token_verify() function returns success for a malformed DPoP\u00a0proof that embeds the private Elliptic Curve (EC) key in the header.\n\nThis issue was fixed in version 2.3.0"}, {"lang": "es", "value": "En liboauth2, el verificador de Demostraci\u00f3n de Prueba de Posesi\u00f3n (DPoP) acepta una prueba cuyo encabezado JSON Web Key (jwk) contiene material de clave privada. RFC 9449 secci\u00f3n 4.3 paso 7 requiere que el verificador rechace dicha prueba, pero la funci\u00f3n oauth2_token_verify() devuelve \u00e9xito para una prueba DPoP malformada que incrusta la clave privada de Curva El\u00edptica (EC) en el encabezado.\n\nEste problema fue corregido en la versi\u00f3n 2.3.0."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "cvd@cert.pl"}