AZL-91682
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91682.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-91682
- Upstream
- Published
- 2026-07-02T11:16:17Z
- Modified
- 2026-08-29T05:25:22Z
- Summary
- CVE-2026-54431 affecting package liboauth 1.0.3-15
- Details
-
In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2tokenverify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header.
This issue was fixed in version 2.3.0
- References