In liboauth2, the DPoP verifier function oauth2_token_verify() accepts a proof whose JSON Web Key header contains private elliptic‑curve key material, a condition prohibited by RFC 9449 section 4.3 step 7. This improper data validation flaw (CWE‑358) allows an attacker to create a malformed DPoP token that the library will incorrectly accept as valid, thereby forging authentication credentials and potentially granting unauthorized access to protected resources.

OpenIDC’s liboauth2 library versions prior to 2.3.0 are affected. Any application, service, or OAuth server that relies on the vulnerable library to validate DPoP proofs during authentication is at risk unless it updates to the patched release.

The vulnerability carries a CVSS score of 5.1, indicating moderate severity, and an EPSS score of less than 1 %, reflecting a very low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to construct and present a DPoP proof embedding private key material to an OAuth server that uses the vulnerable liboauth2. The attack is likely remote, occurring over the network when a client sends an authentication request. No additional privileged access or conditions are described in the security advisory.