Bug 2496464 (CVE-2026-54431)
| Summary: | CVE-2026-54431 liboauth2: liboauth2: DPoP verifier accepts malformed proof with private key material | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in liboauth2. The Demonstrating Proof-of-Possession (DPoP) verifier incorrectly accepts a malformed DPoP proof. This proof contains private key material in its JSON Web Key (JWK) header, which should be rejected according to RFC 9449. This vulnerability could allow an attacker to bypass the intended proof-of-possession mechanism.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2496726 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-07-02 11:01:30 UTC
|