The liboauth2 library contains a flaw in the oauth2_jose_jwks_aws_alb_resolve function, which processes AWS ALB JWT verifiers. The function takes the unverified JWT header, reads the "kid" value, and concatenates it to a configured ALB base URL without performing URL encoding or path sanitization. Based on the description, it is inferred that an attacker can supply a crafted token that forces the library to send a GET request to any internal path or host chosen by the attacker. This vulnerability allows the attacker to read or interact with internal services that are normally inaccessible from the public network, potentially compromising confidentiality, integrity, or availability of internal resources. The weakness is classified under CWE‑918.

All installations of OpenIDC’s liboauth2 library older than version 2.3.0 are affected. The flaw is located in the oauth2_jose_jwks_aws_alb_resolve component that handles AWS ALB JWT verifiers. Any application that embeds or links to liboauth2 from client‑supplied endpoints may be impacted. Versions newer than 2.3.0 contain the fix and are not susceptible.

The base CVSS score is 5.1, indicating moderate severity. The EPSS score of less than 1% signifies a very low likelihood of exploitation in the near term, and the vulnerability is not present in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires the attacker to send a crafted JWT to the server’s token‑handling endpoint; if successful, the server will make an outbound GET request to the attacker‑controlled internal address before verifying the token signature. The resulting SSRF can expose hidden services, leak data, or facilitate lateral movement within the network.