PT-2026-54958 · Liboauth2 · Liboauth2

Marcin Wyczechowski + 1 · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-54431

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions liboauth2 versions prior to 2.3.0

Description The Demonstrating Proof-of-Possession (DPoP) verifier fails to properly validate the JSON Web Key (jwk) header. Specifically, the oauth2 token verify() function returns success even when a malformed DPoP proof embeds private Elliptic Curve (EC) key material in the header, violating RFC 9449 requirements which mandate that such proofs be rejected.

Recommendations Update to version 2.3.0.

Fix

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

CVE-2026-54431

Affected Products

Liboauth2

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-54431 · Security Note
• https://github.com/OpenIDC/liboauth2/commit/c0b57152ed6a0af33aeb04a60bd7f5bff5ab8800 · Note
• https://github.com/OpenIDC/liboauth2 · Note
• https://cert.pl/en/posts/2026/07/CVE-2026-54430 · Note
• https://cert.pl/en/posts/2026/06/CVE-2026-54430 · Note
• https://twitter.com/VulmonFeeds/status/2072649994193027135 · Twitter Post