What is GHSA-3pf6-g4x4-jm46?

GHSA-3pf6-g4x4-jm46 is a security advisory published by GitHub Security Advisories with Medium severity. In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web...

Which CVE IDs does GHSA-3pf6-g4x4-jm46 cover?

GHSA-3pf6-g4x4-jm46 covers the following CVE IDs: CVE-2026-54431. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-3pf6-g4x4-jm46Medium

In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web...

Vendor

GitHub Security Advisories

Published

July 2, 2026

Last Modified

July 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-54431 →

📋 Description

In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header.

This issue was fixed in version 2.3.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-54431
https://github.com/OpenIDC/liboauth2/commit/c0b57152ed6a0af33aeb04a60bd7f5bff5ab8800
https://cert.pl/en/posts/2026/07/CVE-2026-54430
https://github.com/OpenIDC/liboauth2
https://github.com/advisories/GHSA-3pf6-g4x4-jm46