The liboauth2 library in OpenIDC contains an SSRF vulnerability in the oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads the signer and kid fields from an unverified JWT header. If the signer matches the configured ARN, the kid value is appended directly to the alb_base_url without URL encoding or path sanitization. This leads to an HTTP GET request being issued to an attacker-chosen internal path before the JWT signature is verified, enabling SSRF attacks. The vulnerability affects versions prior to 2.3.0 and was fixed in 2.3.0.

An attacker can exploit this vulnerability to make the server perform HTTP GET requests to internal or attacker-controlled URLs, potentially accessing internal resources or services that are otherwise inaccessible externally. The vulnerability does not require user interaction or privileges and has a medium severity with a CVSS 4.0 score of 5.1.

A patch is available and the issue is fixed in liboauth2 version 2.3.0. Users should upgrade to version 2.3.0 or later to remediate this vulnerability. Since this is a cloud-hosted service component, the vendor manages remediation for the cloud service; users should verify with the vendor advisory for confirmation of patch deployment. No additional mitigation steps are indicated.