In liboauth2, the DPoP verifier implemented in oauth2_token_verify() incorrectly accepts JSON Web Keys that contain private elliptic‑curve key material in the header, violating RFC 9449 requirement to reject such proofs. This data‑validation weakness (CWE‑358) allows an attacker to craft a malicious DPoP token that the library treats as valid, enabling forgery of access tokens and potentially granting unauthorized service access.

OpenIDC’s liboauth2 library versions earlier than 2.3.0 are affected. Any application, service, or OAuth server that relies on the vulnerable library to validate DPoP proofs when processing authentication requests is at risk unless it uses the patched release.

The vulnerability has a CVSS score of 5.1, which indicates moderate severity, and an EPSS score of less than 1 %, denoting a very low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to construct and present a DPoP proof containing private key material to an OAuth server that uses the vulnerable liboauth2. The description does not mention privileged access or additional conditions; it is unclear whether such prerequisites are required, which is inferred from the lack of explicit mention.