A path traversal and same-origin Server-Side Request Forgery (SSRF) vulnerability was found in the AWS ALB key resolver of SmallRye JWT. When the AWS_ALB key provider is configured, AwsAlbKeyResolver constructs the verification-key URL by concatenating the configured key location with the attacker-controlled kid value from the inbound, unverified JWT header. The kid value is only checked for null and, optionally, against a configured expected value. Characters such as /, .., ?, and # are not rejected or encoded. An unauthenticated attacker can therefore cause the application server to issue GET requests to arbitrary paths and manipulate query parameters on the configured OIDC/JWKS origin before JWT signature verification. This can be exploited remotely without authentication or user interaction, allowing attackers to read non-public data on the same origin as the configured key endpoint.