CVE-2026-54431

creationtimestamp| type| source ---|---|--- 2026-07-02 13:15:04+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-54430 2026-07-02 23:12:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpp5spl4n62n 2026-07-03 03:30:05+00:00| seen|...

CVE-2026-54431 Improper Data Validation in liboauth2

In liboauth2 the Demonstrating Proof-of-Possession DPoP verifier accepts a proof whose JSON Web Key jwk header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2tokenverify function returns success for a malformed DPoP proof that...