The liboauth2 library processes JSON Web Tokens for AWS ALB authentication. In a key verification routine, the function oauth2_jose_jwks_aws_alb_resolve reads the kid value from an unverified JWT header. When the signer matches the configured ARN, the kid is appended directly to the configured ALB base URL without URL‑encoding or sanitizing the path before performing an HTTP GET. This allows an attacker who can supply a JWT header with a malicious kid to force the server to issue an outbound request to an arbitrary internal path or host. The resulting Server‑Side Request Forgery can expose internal services, leak sensitive data, or facilitate lateral movement within the network. Based on the description, it is inferred that the likely attack vector is sending a crafted JWT with a malicious kid header to the server’s token verification endpoint.

All installations of OpenIDC's liboauth2 with a version older than 2.3.0 are vulnerable. This includes any application, service, or system that links to or embeds the vulnerable library, particularly those that expose token‑handling interfaces to client input.

The CVSS score of 5.1 reflects moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to control the JWT input to the server; once processed, the server makes the outbound GET before signature verification. While no public exploits are reported, the SSRF could potentially expose sensitive internal resources or serve as a foothold for further attacks.