The vulnerability exists in SmallRye JWT's AwsAlbKeyResolver, which constructs the key-fetch URL by concatenating the attacker-controlled kid header from an inbound JWT without sanitizing path traversal characters or query-string separators. This improper input validation enables an unauthenticated attacker to trigger same-origin server-side request forgery (SSRF) by forcing the application server to send GET requests to arbitrary paths on the configured key endpoint's origin. This can lead to unauthorized reading of non-public endpoints or internal data accessible on that origin prior to JWT signature verification. Red Hat assesses the severity as moderate due to the read-only impact and lack of required privileges or user interaction. The vulnerability is tracked as CVE-2026-81829 and is present in cloud services where remediation is managed by the vendor. No effective mitigation or patch is currently available that meets Red Hat's deployment and stability criteria.

An unauthenticated remote attacker can exploit this vulnerability to perform same-origin SSRF attacks, causing the application server to issue GET requests to arbitrary internal paths on the configured key endpoint host. This may expose sensitive non-public or internal data accessible on that origin before JWT signature verification occurs. The impact is limited to confidentiality with no integrity or availability effects. The vulnerability does not require authentication or user interaction and has a low attack complexity.

The vendor advisory states that no effective mitigation is currently available or meets Red Hat's criteria for ease of use, applicability, and stability. Since this is a cloud-hosted service, the vendor manages remediation server-side. Users should monitor the Red Hat advisory for updates on patches or mitigations. No immediate action is recommended until an official fix or mitigation is provided.