Medium5.3Red Hat Linux Updated
DPoP verifier accepts malformed proof with private key material
CVE-2026-54431 Published Jul 2, 2026Updated by vendor Jul 2, 2026
Affected products & platforms
Red Hat LinuxUnclassified
Summary
DPoP verifier accepts malformed proof with private key material. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-358.
Mitigation checklist
Recommended fix / mitigation
- Ensure DPoP client implementations do not include private key material in the JWK header of DPoP proofs. Review client code to verify only the public key is serialized into the proof's jwk header field. Upgrade liboauth2 to version 2.3.0 or later, which adds server-side rejection of proofs containing private key material per RFC 9449 section 4.3.
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.