Bug 2524980 (CVE-2026-81829)

Summary: CVE-2026-81829 smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver
Product: [Other] Security Response Reporter: Abhishek Raj <abhraj>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ant, anujha, asoldano, avibelli, bbaranow, bgeorges, bmaxwell, bstansbe, cescoffi, dandread, dkreling, dlofthou, ewittman, fmongiar, gsmet, istudens, ivassile, iweiss, janstey, jmartisk, kaycoth, lthon, manderse, mosmerov, msvehla, nipatil, nwallace, olubyans, ozzy, pantinor, pberan, pesilva, pgallagh, pjindal, pmackay, probinso, rguimara, rkubis, rruss, rstancel, rsvoboda, sbiarozk, security-response-team, thjenkin, tqvarnst, varjain, vdosoudi
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-10-15   

Description Abhishek Raj 2026-08-27 14:08:16 UTC 
A path traversal and same-origin Server-Side Request Forgery (SSRF) vulnerability was found in the AWS ALB key resolver of SmallRye JWT. When the AWS_ALB key provider is configured, AwsAlbKeyResolver constructs the verification-key URL by concatenating the configured key location with the attacker-controlled kid value from the inbound, unverified JWT header. The kid value is only checked for null and, optionally, against a configured expected value. Characters such as /, .., ?, and # are not rejected or encoded. An unauthenticated attacker can therefore cause the application server to issue GET requests to arbitrary paths and manipulate query parameters on the configured OIDC/JWKS origin before JWT signature verification. This can be exploited remotely without authentication or user interaction, allowing attackers to read non-public data on the same origin as the configured key endpoint.
Comment 2 Abhishek Raj 2026-09-17 13:47:04 UTC