go-oidc-provider

English

日本語

English

日本語

Appearance

CVE regression matrix ​

When a CVE is published against another OIDC / OAuth / JOSE implementation, the question for this library is "could the same defect reach us, and if not, why not?". The honest answer needs more than a code review — it needs a test that fails the build if a future refactor reintroduces the bypass.

This page is the public ledger of those tests. Every advisory in the covered sections has at least one unit / fuzz test that exercises the surface and pins the rejection. Advisories that are only class-level, or out of scope for an OP, sit in their own sections further down and are not counted as pinned. The test references are stable — if an entry points at a file or test name, it lives in the repository.

How a row gets into the matrix
A CVE filed against another implementation is reduced to its defect class. That class is then checked for reachability in this codebase: where it is reachable, a refusal test pins the behaviour; where it is not, the structure already excludes it.An external CVEfiled against a differentimplementationIts defect classalg confusion, kid traversalthe shape, not the instanceIs it reachable here?asked of the code structure,not of its version numbernoyesExcluded by constructionnothing here to regressA refusal testpinned, so it cannot regress
A row is never "we are not affected". It is either a test that fails if the defect is ever reintroduced, or a statement about why the code has no place for it — and the second kind is re-checked when that code changes.

Reading an entry

  • Disclosure — the original advisory, filed against another implementation, with the affected project beside it. We do not maintain CVE entries against this library; the ID tells you what class of defect the test is meant to keep out. Each ID links to its public record.
  • Defect class · spec — the underlying defect (alg confusion, redirect-uri matching, PKCE downgrade, ...) and the spec section the test pins behaviour against.
  • Regression test — the test that fails if the surface regresses, as package.TestName. A note under a test marks where its coverage is narrower than the advisory.
177pinned by a regression test
7listed at class level only
36out of scope for an OP

JOSE / JWT verification ​

51 advisoriespinned by a regression test

GHSA-pxh4-856f-4h89PyJWT

a token was verified under a symmetric oct JWK with an empty k

RFC 7518 §6.4 / RFC 8725 §3.1

  • internal/jose.TestParseJWKSet_RejectsSymmetricKeyinbound JWK Sets never yield a symmetric key, with an empty or non-empty k

GHSA-mgcc-cww5-fp2qgo-jose

CPU exhaustion parsing a JWK with an oversized RSA key

CWE-400

  • internal/dpop.TestVerify_RejectsOversizedProofa DPoP proof over 8 KiB is rejected before its embedded jwk is parsed

GHSA-vvm8-gf78-28g4go-jose

JSON parsing panics

CWE-248

  • internal/jose.FuzzJOSEParsethe no-panic contract of the JWS entry point
  • internal/jose.FuzzDecodeJWKSetthe no-panic contract of the JWK Set entry point

GHSA-4w3g-jfj2-cw2qgo-jose

panic while processing an AES-CBC-HMAC JWE

RFC 7518 §5.2

  • internal/jose.TestDecrypt_EncAllowListevery CBC-HMAC enc is refused before the JOSE layer parses anything

GHSA-c67m-wr4h-2ccggo-jose

quadratic CPU on a JSON-serialised JWS or JWE with many signatures or recipients

RFC 7515 §7.2 / RFC 7516 §7.2

  • internal/jose.TestParseSigned_RejectsJSONSerialisationShapesJWS parsing is compact-only
  • internal/jose.TestDecrypt_RejectsJSONSerialisationa 64-recipient general-form JWE is refused

GHSA-p9j4-2j95-j4rvgo-jose

unprotected JWE headers overrode protected fields whose value was empty or null

RFC 7516 §7.2.1

  • internal/jose.TestDecrypt_RejectsJSONSerialisationcompact serialisation carries no unprotected header; a JSON JWE with one is malformed

GHSA-v6h2-qj3f-2h6vgo-jose

CPU exhaustion in Header.Certificates() on an x5c chain with a huge RSA key

RFC 7515 §4.1.6

  • internal/jose.TestNoForbiddenJOSECallsx5c is never a trust source; non-test code calling Certificates() fails the build

GHSA-27pc-rm86-68pqgo-jose

the JSON fork panicked decoding a claim into a struct embedding an unexported type

CWE-248

  • internal/jose.TestNoForbiddenJOSECallsinbound payloads decode through encoding/json; non-test code reaching the fork through jwt.ParseSigned, ParseSignedAndEncrypted or UnsafeClaimsWithoutVerification fails the build

CVE-2015-9235jsonwebtoken

alg=none accepted

RFC 8725 §3.1

  • internal/jose.FuzzJOSEParsealg=none seed
  • internal/tokens.TestVerify_AlgConfusion_HSUsingECPublicKeyBytesAsSecret
  • internal/jose.TestParseAlgorithm_CaseVariantsRejected

CVE-2016-10555jwt-simple

alg=HS256 accepted, treats public key as HMAC secret

RFC 8725 §2.1

  • internal/tokens.TestVerify_AlgConfusion_HSUsingECPublicKeyBytesAsSecret
  • internal/jose.FuzzJOSEParse

CVE-2015-2951jose4j

alg=none accepted

RFC 8725 §3.1

  • internal/jose.FuzzJOSEParse
  • internal/jose.TestParseAlgorithm_CaseVariantsRejected

CVE-2024-54150cjwt

algorithm confusion

RFC 8725 §2.1

  • internal/tokens.TestVerify_AlgConfusion_HSUsingECPublicKeyBytesAsSecret

CVE-2026-22817CVE-2026-27804CVE-2026-23552Hono JWT 2026 cluster

case-variant alg=NONE bypass of deny-list

RFC 8725 §3.1

  • internal/jose.TestParseAlgorithm_CaseVariantsRejected
  • internal/jose.FuzzJOSEParsecase-variant seeds
  • internal/tokens.TestVerify_AlgConfusion_HSUsingECPublicKeyBytesAsSecret

CVE-2026-33322MinIO OIDC

algorithm confusion

RFC 8725 §2.1

  • internal/tokens.TestVerify_AlgConfusion_HSUsingECPublicKeyBytesAsSecret

CVE-2026-48526PyJWT

asymmetric public JWK accepted as an HMAC verification secret

RFC 8725 §2.1

  • internal/tokens.TestVerify_AlgConfusion_HSUsingECPublicKeyBytesAsSecret

CVE-2018-0114Cisco / node-jose

trusted jwk header — verifier used key from JWS itself

RFC 7515 §4.1.3 / RFC 8725 §3.10

  • internal/jose.TestParseSigned_HeaderInjection_NeverFetches
  • internal/jose.FuzzJOSEParsejku seed

CVE-2018-1000531inversoft prime-jwt

alg header downgrade + trusted jwk

RFC 7515 §4.1.3 / RFC 8725 §3.1

  • internal/jose.TestParseSigned_HeaderInjection_NeverFetches

CVE-2017-11424python-jose-style

jku resolved from header

RFC 8725 §3.10

  • internal/jose.TestParseSigned_HeaderInjection_NeverFetches

CVE-2019-7644Auth0 jsonwebtoken-koa

trusted jwk header

RFC 7515 §4.1.3

  • internal/jose.TestParseSigned_HeaderInjection_NeverFetches

CVE-2026-34240GHSA-vm9r-h74p-hg97Dart jose

trusted jwk header — verifier treated attacker-supplied key material as a candidate verification key

RFC 7515 §4.1.3 / RFC 8725 §3.10

  • internal/jose.TestParseSigned_HeaderInjection_NeverFetches

CVE-2025-59420Authlib

crit extension list ignored

RFC 7515 §4.1.11

  • internal/jose.TestParseSigned_CritHeaderRejectedAtVerify

CVE-2026-32597PyJWT

same crit-ignored defect

RFC 7515 §4.1.11

  • internal/jose.TestParseSigned_CritHeaderRejectedAtVerify

CVE-2026-28498Authlib

hash-binding verifier fail-opened when handed an unknown / unsupported alg

RFC 8725 §3.1

  • internal/jose.TestParseSigned_RejectsUnsupportedRegisteredAlg_NoFailOpen

GHSA-jc38-x7x8-2xc8JOSE library

an unprotected JWS header allowed an algorithm downgrade

RFC 8725 §3.1

  • internal/jose.TestParseSigned_RejectsMultiSignatureForm
  • internal/jose.TestParseSigned_RejectsUnsupportedRegisteredAlg_NoFailOpencompact-only and algorithm allow-list checks

CVE-2026-29000pac4j-jwt

JWE decryption was treated as authentication; an unsigned / plain inner JWT was accepted after decrypt

RFC 8725 §2.3 / RFC 9101 §6.1

  • internal/jar.TestVerify_RejectsJWEWrappedUnsignedJWT

CVE-2024-29371CVE-2025-62706jose4j / Authlib JWE decompression bomb

resource exhaustion via a crafted compressed JWE (zip); the decrypt path bounds decompressed plaintext

CWE-409

  • internal/jose.TestDecrypt_ZipBombResistance
  • internal/jose.TestDecrypt_PlaintextSizeCap_OverLimit

CVE-2026-27962Authlib

verifier trusted an attacker-supplied jwk header

RFC 7515 §4.1.3 / RFC 8725 §3.10

  • internal/jose.TestParseSigned_HeaderInjection_NeverFetches
  • internal/clientauth.TestPrivateKeyJWTVerifier_KeySelectionIgnoresTheAssertionsOwnHeader

CVE-2026-48525CVE-2025-61920PyJWT / Authlib

oversized JOSE segment caused resource exhaustion before rejection

CWE-400

  • test/scenarios.TestEndpoints_OversizedJWSIsRefusedBeforeItIsDecoded

CVE-2026-49852GHSA-gg9x-qcx2-xmrh

a degenerate HMAC key enabled HS256 forgery; HS256 is excluded at the algorithm boundary

RFC 8725 §2.2 / §3.5

  • internal/jar.TestParse_RejectsHMAC
  • internal/tokens.TestVerify_RejectsHS256AsMalformedHS256 exclusion only; no minimum HMAC-key-length test

CVE-2026-27932GHSA-w5r5-m38g-f9f9

unbounded PBES2 p2c iterations caused JWE key-derivation DoS; PBES2 is refused before KDF

RFC 7518 §4.8.1.2 / §8.6

  • internal/jose.TestDecrypt_AlgAllowList

CVE-2026-102268CVE-2026-102271CVE-2026-102273PyJWT

a PEM with mutated whitespace, a DER public key, or a public JWK container was reinterpreted as an HMAC secret

RFC 8725 §2.1

  • internal/tokens.TestVerify_AlgConfusion_HSUsingECPublicKeyBytesAsSecretHS* is refused at parse time, before any key is handled

CVE-2026-107722CVE-2026-107724fast-jwt

GHSA-7vr2-2fgp-9w7pAuthlib

the same key-reinterpretation class: a prefixed PEM, raw public JWK JSON, or a leading byte that defeated the PEM guard

RFC 8725 §2.1

  • internal/tokens.TestVerify_AlgConfusion_HSUsingECPublicKeyBytesAsSecret

CVE-2026-102266PyJWK

GHSA-8m4g-j4wp-wgcgAuthlib

an empty HMAC key was accepted

RFC 8725 §2.2 / §3.5

  • internal/tokens.TestVerify_RejectsHS256AsMalformed
  • internal/jose.TestAlgorithm_IsAllowedno symmetric alg is on the allow-list, whatever the key

CVE-2026-107720fast-jwt

an unsigned JWT was accepted when the key was empty or null

RFC 8725 §3.1

  • internal/jose.TestParseSigned_CaseVariantNoneRejectedParseSigned takes no key and always refuses none
  • internal/tokens.TestVerify_UnknownKidReturnsSignatureErrora key-lookup miss fails closed

CVE-2026-96760Authlib

deserialize_json() returned a signature-less JSON JWS as verified

RFC 7515 §7.2

  • internal/jose.TestParseSigned_RejectsJSONSerialisationShapesParseSigned is compact-only

CVE-2026-107723fast-jwt

claim validation was skipped for a JSON-array payload

RFC 7519 §7.2

  • internal/tokens.TestVerify_RejectsNonObjectPayloads
  • internal/jar.TestVerify_RejectsNonObjectPayloads
  • internal/dpop.TestVerify_RejectsNonObjectPayloads
  • internal/clientauth.TestPrivateKeyJWTVerifier_RejectsNonObjectPayloads

CVE-2026-107721fast-jwt

clockTolerance: Infinity disabled the exp / nbf checks

RFC 7519 §4.1.4

  • internal/tokens.TestVerify_LeewayIsBoundedConstant
  • internal/clientauth.TestPrivateKeyJWTVerifier_ExpLeewayIsBoundedConstantskew is a package constant with no public option

CVE-2026-107719fast-jwt

a verifier result cache kept accepting an expired JWT

RFC 7519 §4.1.4

  • internal/tokens.TestVerify_ExpiryTracksClockAcrossCallsno verification-result cache exists

CVE-2026-103001PyJWT

a caller-supplied options dict was mutated, disabling claim checks on reuse

CWE-374

  • internal/jar.TestNewVerifier_IsolatedFromCallerConfiglater edits to the config leave the verifier policy unchanged

CVE-2026-102269PyJWT

non-canonical signature segments defeated a revocation list keyed on the raw token

RFC 7515 §5.2 / RFC 7519 §4.1.7

  • internal/clientauth.TestPrivateKeyJWTVerifier_ReplayKeysOnJTINotRawAssertion
  • internal/dpop.TestVerify_ReplayKeysOnJTINotRawProofa re-signed token with the same jti is a replay

GHSA-r39w-98wm-9pp6go-jose

an RSA JWK with exponent 0 decoded without error, and computing its thumbprint panicked

RFC 7638 §3 / RFC 7518 §6.3.1

  • internal/jose.TestDecodeJWKSetthe degenerate member is dropped from a decoded JWKS
  • internal/mtls.TestVerifySelfSigned_ZeroExponentRSAKeyIgnoreda registered client JWKS carrying it still authenticates with its usable key

Authorize / redirect_uri ​

18 advisoriespinned by a regression test

CVE-2026-9086another OP

a case-variant javascript: or data: redirect URI passed validation

RFC 3986 §3.1

  • internal/registrationendpoint.TestValidateRedirectURIs_CaseVariantDangerousSchemesschemes are parsed and lowercased before the allow-list; redirect and post-logout URIs, web and native clients

GHSA-jj7h-c3hg-m23xAuthlib

the loopback exemption was prefix-matched, so http://localhost:[email protected]/cb passed

RFC 8252 §7.3

  • internal/registrationendpoint.TestValidateRedirectURIs_LoopbackUserinfoSmugglingat registration
  • internal/authorize.TestRequest_Validate_LoopbackWildcardRejectsUserinfoSmugglingat /auth

GHSA-86wh-7qgj-4px7Doorkeeper

the deny path redirected to an unvalidated redirect_uri

RFC 6749 §10.15

  • internal/authorizeendpoint.TestInteractionDelete_DenyIgnoresRequestRedirectParamsthe cancel answers from server-stored request state; redirect_uri, client_id and response_type in the deny request are ignored

CVE-2024-10318NGINX OIDC reference

front-channel id_token issued without nonce binding → session fixation

OIDC Core §15.5.2 / RFC 9700 §2.1.2

  • internal/authorize.TestRequest_Validate_RejectsImplicitAndHybridResponseTypesresponse_type=code only
  • internal/backchannel.TestSignLogoutToken_EmitsRequiredClaimsa logout token carries no nonce and a distinct typ, so it cannot pass as an ID token

CVE-2024-8883Keycloak

wildcard / suffix bypass of an earlier redirect_uri patch

RFC 6749 §3.1.2.3 / RFC 9700 §4.1

  • internal/authorize.TestRequest_Validate_RedirectURIAttackVariants

CVE-2020-15234ory/fosite

case-variant redirect_uri matched a case-different registration

RFC 6749 §3.1.2.3

  • internal/authorize.TestRequest_Validate_RedirectURIAttackVariants

GHSA-rfq3-w54c-f9q5ory/fosite

loopback redirect rule allowed host / query override; fix narrows runtime variation to the port only — exact-string match here is even stricter

RFC 6749 §3.1.2.3 / RFC 9700 §4.1

  • internal/authorize.TestRequest_Validate_RedirectURIAttackVariants

CVE-2026-7571Keycloak

disabled implicit-flow control bypass; front-channel access-token disclosure via a forged client state

RFC 9700 §2.1.2

  • internal/authorize.TestRequest_Validate_RejectsImplicitAndHybridResponseTypes

CVE-2026-3872Keycloak

wildcard redirect_uri path traversal using ..;/

RFC 6749 §3.1.2.3 / RFC 9700 §4.1

  • internal/authorize.TestRequest_Validate_RedirectURIAttackVariants

CVE-2026-7504Keycloak

wildcard redirect_uri parser confusion through multiple @ bytes in the authority / userinfo segment

RFC 6749 §3.1.2.3 / RFC 9700 §4.1

  • internal/authorize.TestRequest_Validate_RedirectURIAttackVariants

CVE-2026-9689Keycloak

HTTP parameter pollution: duplicated OIDC authorization request parameters were reflected into the authorization response as duplicated response parameters

RFC 6749 §3.1 / RFC 9700 §4.1

  • internal/authorize.TestParseValues_DuplicateParameter

CVE-2026-44681Authlib

malformed authorization request redirected to an attacker-chosen, unvalidated redirect_uri instead of returning a first-party error

RFC 6749 §4.1.2.1 / RFC 9700 §4.11.2

  • internal/authorizeendpoint.TestAuthorize_RejectsBadRedirectURIWithJSON
  • internal/authorize.TestIsRedirectSafe_ParseTimeErrorsAreNeverRedirectSafe

CVE-2026-32235Backstage auth-backend

DCR redirect-URI allow-list bypass

RFC 6749 §3.1.2.3 / RFC 9700 §4.1

  • internal/registrationendpoint.TestDCR_RegisteredRedirectURIIsMatchedByteExactly
  • internal/registrationendpoint.TestDCR_RejectsRedirectURIShapesThatBlurTheMatch

CVE-2026-12985dynamic client registration

ambiguous redirect URI shape accepted at registration

RFC 6749 §3.1.2.3 / RFC 9700 §4.1

  • internal/registrationendpoint.TestDCR_RejectsRedirectURIShapesThatBlurTheMatchregistration-shape rejection only

CVE-2026-96446PAR

concurrent reuse of a pushed authorization request request_uri

RFC 9126 §2.2 / §4

  • op/store/contract.concurrentPARConsumestore contract has one winner; no prompt=none handler-specific path

CVE-2026-41479Authlib

parse-time authorize error redirected to an untrusted redirect_uri

RFC 6749 §4.1.2.1 / RFC 9700 §4.11.2

  • internal/authorize.TestIsRedirectSafe_ParseTimeErrorsAreNeverRedirectSaferedirect-safety predicate; not a full browser flow

GHSA-mxv6-xwqj-ww2pDuende

a pushed authorization request was not bound to the client that pushed it

RFC 9126 §2.2 / §4

  • internal/parendpoint.TestHandler_ClientIDMismatch_Rejected
  • internal/parendpoint.TestEndToEnd_PAR_RequestURIBoundToPushingClient/auth refuses another client's request_uri and leaves the record unconsumed

GHSA-q686-2qmg-hqc7Authlib

ID token issuance was decided on the raw requested scope, outside the client-registration clamp

OIDC Core 1.0 §3.1.2.1

  • internal/authorize.TestValidate_OpenIDScopeIsClampedToClientRegistrationopenid gets no exemption

PKCE / code exchange ​

5 advisoriespinned by a regression test

CVE-2024-23647authentik ≤2023.10.6, CVSS 6.1

/token accepted code_verifier on codes minted without a code_challenge — PKCE downgrade. The library also refuses non-PKCE authorization-code issuance to public / native clients at /auth; the token-side guard remains defense in depth

RFC 9700 §4.8 / RFC 7636 §4.6

  • internal/authorize.TestRequest_Validate_PublicClientAlwaysRequiresPKCE
  • test/scenarios.TestScenario_PKCE_007_PublicClientCodeRequiresPKCE
  • internal/grants/authcode.TestExchange_NoPKCE_RejectsSmuggledVerifier

CVE-2025-4144Cloudflare workers-oauth-provider <0.0.5, CVSS 8.1

same downgrade variant in a different ecosystem; public / native clients are blocked before a non-PKCE code can be minted

RFC 9700 §4.8

  • internal/authorize.TestRequest_Validate_PublicClientAlwaysRequiresPKCE
  • test/scenarios.TestScenario_PKCE_007_PublicClientCodeRequiresPKCE
  • internal/grants/authcode.TestExchange_NoPKCE_RejectsSmuggledVerifier

CVE-2026-26247GHSA-m5ch-ppfx-xv3v

PKCE S256 was downgraded to plain or an absent challenge

RFC 7636 §4.6 / RFC 9700 §4.8

  • internal/pkce.TestVerify_RejectsPlainMethod
  • internal/tokenendpoint.TestAuthCode_PublicClient_NoPKCE_Rejected

CVE-2026-49265oauthlib

the plain verifier was compared with string equality

RFC 7636 §4.6

  • internal/pkce.TestVerify_RejectsPlainMethodplain is refused, so the raw verifier is never compared; the S256 digest comparison is constant-time

CVE-2026-105119OpenAM

PKCE was enforced only for response_type=code

RFC 7636 §4.4 / RFC 9700 §4.8

  • internal/authorize.TestRequest_Validate_RejectsImplicitAndHybridResponseTypesonly code is accepted, so every issued code passes the PKCE check

Authorization code interception (cross-client retrieval) ​

5 advisoriespinned by a regression test

GHSA-vh7g-p26c-j2cwdexidp/dex, 2024

back-channel ID-token retrieval after authorization-code interception — redeeming the code under a different client_id returned tokens minted for the victim. Structural mitigation: the (code, client_id, redirect_uri[, code_verifier]) tuple must match at exchange

RFC 6749 §4.1.3 / RFC 9700 §4.5 / OIDC Core §3.1.3.2

  • internal/grants/authcode.TestExchange_RejectsClientMismatch

CVE-2026-4282Keycloak

authorization-code forgery through a shared single-use-object namespace

RFC 6749 §4.1.3

  • op/store/contract.namespaceDisjoint
  • op/store/contract.namespaceConsumeIsScoped

CVE-2026-53518GHSA-7w99-5wm4-3g79

concurrent authorization-code redemption let more than one request succeed

RFC 6749 §4.1.3

  • op/store/contract.concurrentAuthCodeConsumestore contract has one winner

CVE-2026-16089authorization code and refresh token

authorization code and refresh token were redeemable by a different client

RFC 6749 §4.1.3 / RFC 6749 §6

  • internal/grants/authcode.TestExchange_RejectsClientMismatch
  • test/scenarios.TestScenario_REF_004_RefreshClientMismatchRejectedboth grant types tested

CVE-2026-73179Apache CXF

code single-use was enforced with a non-atomic find-then-delete

RFC 6749 §4.1.2

  • op/store/contract.concurrentAuthCodeConsumestore contract: one winner

Client authentication / private_key_jwt ​

17 advisoriespinned by a regression test

GHSA-7984-qgvg-3j9coauthlib

one client was authenticated but the grant was authorised against a different client_id in the body

RFC 6749 §3.2.1

  • test/scenarios.TestScenario_CA_COMMON_05_BodyClientIDMismatchRejected
  • test/scenarios.TestScenario_CA_BASIC_05_BasicHeaderBodyClientIDMismatch
  • test/scenarios.TestAdvisory_BodyClientIDMismatchAcrossGrantsAndEndpointsa mismatching body client_id is invalid_client across refresh_token, client_credentials, PAR, introspection and revocation

CVE-2025-27370OIDF coordinated, OIDC

private_key_jwt aud confusion: malicious AS could relay a key reused across ASs and impersonate the client

draft-ietf-oauth-rfc7523bis (Internet-Draft) / FAPI 2.0 Security Profile §5.3.2.1 item 8

  • internal/clientauth.TestPrivateKeyJWTVerifier_AudIssuer_AcceptedViaAuxAudiences
  • internal/clientauth.TestPrivateKeyJWTVerifier_AudOtherAS_Rejected

CVE-2025-27371IETF coordinated, OAuth 2.0

same defect, OAuth profile lineage

draft-ietf-oauth-rfc7523bis (Internet-Draft)

  • internal/clientauth.TestPrivateKeyJWTVerifier_AudIssuer_AcceptedViaAuxAudiences
  • internal/clientauth.TestPrivateKeyJWTVerifier_AudOtherAS_Rejected

CVE-2020-15222GHSA-mh3m-8c74-74xhory/fosite < 0.31.0

private_key_jwt jti uniqueness not enforced — assertion replay

RFC 7523 §3 / CWE-345

  • internal/clientauth.TestPrivateKeyJWTVerifier_JTIReplay_Rejected

GHSA-v3q9-2p3m-7g43ory/fosite, 2020 cluster

same jti-replay defect class re-disclosed under a separate GHSA — structural mitigation is identical (per-jti single-use within the assertion's exp window)

RFC 7523 §3 / CWE-345

  • internal/clientauth.TestPrivateKeyJWTVerifier_JTIReplay_Rejected

CVE-2026-1180Keycloak

jwks_uri SSRF during dynamic-client private_key_jwt key resolution

RFC 7591 §2 / RFC 7523 §3

  • internal/securefetch.TestPolicy_SSRFContract

CVE-2024-53861PyJWT

issuer comparison accepted a prefix rather than a whole-string match

RFC 7523 §3

  • internal/clientauth.TestPrivateKeyJWTVerifier_IssuerMustMatchWholly

CVE-2026-11800Keycloak

client assertion key selection or algorithm policy was steered by JOSE headers

RFC 8725 §3.1 / §3.10

  • internal/clientauth.TestPrivateKeyJWTVerifier_KeySelectionIgnoresTheAssertionsOwnHeader
  • internal/clientauth.TestPrivateKeyJWTVerifier_RejectsAlgOutsideClientPin

CVE-2026-16093client assertion

an unsigned none assertion satisfied a policy requiring signed client authentication

RFC 8725 §3.1

  • internal/jose.TestParseSigned_CaseVariantNoneRejected
  • internal/clientauth.TestVerifyClient_AllowedMethodsRejectsOutOfPolicy

CVE-2026-47426GHSA-f2cx-463q-7m2c

a JWKS-cache kid collision crossed a client boundary

RFC 8725 §3.10

  • internal/clientauth.TestPrivateKeyJWTVerifier_KeySelectionIgnoresTheAssertionsOwnHeaderclient-scoped key selection; no cache-specific test

CVE-2026-48523PyJWT

a registered JWK widened the verifier algorithm policy

RFC 8725 §3.1

  • internal/clientauth.TestPrivateKeyJWTVerifier_RegisteredKeyCannotWidenTheAlgorithmPolicy

CVE-2026-22746Spring Security

timing difference on unknown client identifiers allowed account enumeration

CWE-208

  • internal/clientauth.TestVerifyClient_PrivateKeyJWT_UnknownClient_DummyVerifyShim
  • internal/clientauth.TestPrivateKeyJWTVerifier_NoKeysRunsTimingShim

CVE-2026-53431client assertion

an expired client assertion was accepted for authentication

RFC 7523 §3

  • internal/clientauth.TestPrivateKeyJWTVerifier_RejectsExpiredonly the expired-claim case is pinned

GHSA-fch4-3c6x-j4gcAuthlib

a JWT bearer grant checked only that aud was present (this OP has no jwt-bearer grant; the same binding governs client_assertion)

RFC 7523 §3

  • internal/clientauth.TestPrivateKeyJWTVerifier_AudOtherAS_Rejected

GHSA-c8r6-23w7-5q9pDoorkeeper

several client authentication methods were accepted in one request

RFC 6749 §2.3

  • internal/clientauth.TestParse_AmbiguousBasicAndFormErrAmbiguousCredentials

CVE-2026-59358UAA

a Bearer access token was accepted as client authentication on client_credentials

RFC 6749 §2.3

  • internal/tokenendpoint.TestClientCredentials_BearerAccessTokenIsNotClientAuthentication401 invalid_client, no token

Remote JWKS and fetch safety ​

3 advisoriespinned by a regression test

CVE-2026-48522PyJWKClient

unrestricted jwks_uri scheme enabled local or non-HTTP resource fetches

RFC 7591 §2

  • internal/registrationendpoint.TestDCR_ClientMetadataIsTreatedAsAttackerInput
  • internal/jar.TestFetcher_JWKSURISchemeIsConstrainedToTheNetwork

CVE-2026-48524PyJWKClient

unknown kid values forced unbounded JWKS refetches

CWE-400

  • internal/jar.TestFetchFresh_BypassesFreshCacheThenThrottles
  • internal/jar.TestJWKSCache_SingleflightCollapsesConcurrentFetches

GHSA-x4rv-c3wx-4cr8Authlib

a JAR request_uri was fetched without checking the client's registered request_uris

RFC 9101 §5.2

  • internal/authorizeendpoint.TestFetchJARRequestURI_RejectsUnregisteredURIthe preregistration gate fires before any network fetch, which then goes through securefetch

Token introspection ​

3 advisoriespinned by a regression test

Introspection is available only to confidential callers: a public client or a client using token_endpoint_auth_method=none receives 401 invalid_client before token resolution. A confidential caller may introspect its own access or refresh tokens; an access token issued to another client is visible only when the target resource lists the caller in ProtectedResource.IntrospectionClients. Refresh tokens are never delegated across clients, and unauthorized cross-client access tokens use the same inactive response shape as any other inactive token.

CVE-2026-37979Keycloak

token introspection audience bypass — a confidential client could retrieve claims for another resource server's token without an audience-scoped delegation

RFC 7662 §2.2

  • internal/introspectendpoint.TestHandler_JWTAccessToken_DifferentClient
  • internal/introspectendpoint.TestHandler_OpaqueAccessToken_DifferentClient

CVE-2026-8922Keycloak

one revocation input shadowed another and left a revoked token active

RFC 7662 §2.2

  • internal/introspectendpoint.TestEndToEnd_ActiveHonoursEveryRevocationInput

CVE-2026-18208introspection

introspection exposed a cross-client or revoked token

RFC 7662 §2.2

  • internal/introspectendpoint.TestHandler_JWTAccessToken_DifferentClient
  • internal/introspectendpoint.TestHandler_OpaqueAccessToken_Revokedthe two cases are tested separately

Access-token presentation ​

4 advisoriespinned by a regression test

GHSA-rvq5-wwqv-78pqGHSA-w4fh-qvv9-3v23MCP TypeScript SDK / MCP Python SDK

bearer verification accepted a token issued for another resource server

RFC 9068 §4

  • op/rs.TestVerifier_AudienceShapesop/rs requires an audience at construction and rejects any aud without it on the JWT path
  • op/rs.TestVerifier_IntrospectedTokenObeysClaimRulesthe same rule on the introspection path

GHSA-c62j-746x-gfcrDoorkeeper

a token presented through several methods at once was authorised

RFC 6750 §2

  • internal/userinfo.TestHandler_POST_BothChannelsRejectedheader plus body is invalid_request; the query string is never read

CVE-2025-7043ForgeRock

a refresh token was accepted as an access token

RFC 6749 §7 / RFC 7662 §2.2

  • internal/userinfo.TestHandler_RefreshTokenAsBearerRefused
  • internal/introspectendpoint.TestHandler_RefreshToken_CarriesNoAccessTokenType

Refresh token rotation ​

9 advisoriespinned by a regression test

CVE-2026-1035Keycloak

refresh-token reuse bypass via TOCTOU race in rotation enforcement

RFC 9700 §4.14.2 / RFC 6749 §6

  • op/storeadapter/inmem.TestConsumeRefresh_Race

CVE-2026-9802Keycloak

restart reset an in-process stale-token verdict, making rotated refresh tokens replayable

RFC 9700 §4.14.2 / RFC 6749 §6

  • internal/grants/refresh.TestExchange_RotationVerdictSurvivesAProcessThatNeverSawTheRotation

CVE-2026-53517GHSA-392p-2q2v-4372

concurrent refresh rotation forked two live successors

RFC 6749 §6 / RFC 9700 §4.14.2

  • op/store/contract.concurrentRefreshConsume
  • op/store/contract.concurrentRefreshRotationstore contract covers consume and rotation

CVE-2026-86073GHSA-cw9w-vv67-hf73

a refresh request's resource indicator widened the token audience

RFC 8707 §2.2 / RFC 6749 §6

  • test/scenarios.TestRefreshTokenIgnoresRequestSuppliedResourcethe request parameter is ignored on refresh

CVE-2026-53512GHSA-pw9m-5jxm-xr6h

refresh-token grant lacked confidential-client authentication

RFC 6749 §6

  • test/scenarios.TestRefreshTokenGrantRejectsMissingClientAuthenticationmissing-credential case; wrong and none variants have sibling tests

CVE-2026-16103deprovisioned subject

a deprovisioned subject could redeem stale refresh or access tokens

RFC 6749 §6

  • internal/tokenendpoint.TestDeprovisionedSubject_RefreshRefusedAndGrantTornDown
  • test/scenarios.TestSubjectDeprovisioning_RefreshRefusedAndAccessTokenDeadrefresh and access-token cases; sibling tests cover code and CIBA

CVE-2026-90997MySQL CLIENT_FOUND_ROWS

CLIENT_FOUND_ROWS broke single-use consumption in the SQL store

RFC 6749 §6 / store contract

  • op/storeadapter/sql.TestMySQL_ClientFoundRows_FullContractrequires a MySQL environment

CVE-2026-101023Gitea

the refresh grant accepted an access token

RFC 6749 §6

  • internal/tokenendpoint.TestRefreshGrant_AccessTokenPresentedAsRefreshTokenRefusedJWT and opaque access tokens

CVE-2026-107162Express Gateway

the refresh grant bound the token to neither the secret nor the client

RFC 6749 §6

  • test/scenarios.TestScenario_REF_004_RefreshClientMismatchRejected

Session lifecycle (fixation / rotation) ​

10 advisoriespinned by a regression test

GHSA-84fg-x5h4-w8xvanother OP

a step-completion proof was kept in a cookie derived from client-known values

CWE-565

  • internal/authorizeendpoint.TestInteraction_ProofCookieNotDerivableFromClientKnownValuesplaintext or client-computable values, and a cookie from another interaction, are refused

GHSA-mchc-246r-6m76another OP

emailed links were built from client-supplied forwarding headers

OIDC Discovery 1.0 §3

  • test/scenarios.TestAdvisory_EmittedURLsIgnoreHostHeadershostile Host, X-Forwarded-* and Forwarded headers do not change any absolute URL the OP emits

GHSA-q735-3ffp-vv6jDoorkeeper

every owner-less grant matched through a nil resource owner

OIDC RP-Initiated Logout 1.0

  • internal/endsession.TestHandler_LogoutLeavesSubjectlessGrantUntouchedlogout revocation skips empty subjects; grant management is keyed by grant_id and client

GHSA-xhpr-465j-7p9qKeycloak, 2024

first-login phishing via email verification (CWE-384 session fixation) — a session that pre-existed the trust transition continued to be authoritative after verification, letting an attacker who planted the cookie ride the post-verification trust. Structural mitigation: rotate session ID on the trust boundary, but preserve CreatedAt so an attacker cannot extend lifetime by triggering rotation

CWE-384 / OIDC Core §3.1.2.3

  • internal/sessions.TestManager_Rotate_IssuesFreshIDPreservingChooserGroup
  • internal/sessions.TestManager_Rotate_PreservesCreatedAt

CVE-2026-7507Keycloak

OIDC-login session fixation → account takeover; a pre-seeded session ID survived fresh authentication. Structural mitigation: rotate the cookie-bound session ID when a fresh authn factor completes at the authorize / interaction boundary, and delete the old session record

CWE-384 / OIDC Core §3.1.2.3

  • internal/authorizeendpoint.TestInteractionPost_RotatesSessionIDAfterFreshAuthn

CVE-2025-68158Authlib

URL-carried interaction state was resolved by a browser other than the one that started it

CWE-384 / OIDC Core §3.1.2.3

  • internal/authorizeendpoint.TestInteraction_ResolvesOnlyForTheBrowserThatStartedIt

CVE-2026-97176Keycloak

ACR step-up accepted a weaker reused session

OIDC Core §3.1.2.3 / RFC 9470 §4

  • internal/authorizeendpoint.TestEndToEnd_ACRStepUp
  • internal/authorizeendpoint.TestEndToEnd_SessionReuseReportsTheLevelReachedstep-up and reported ACR are tested separately

CVE-2026-105118OpenAM

end_session accepted an unverified id_token_hint

OIDC RP-Initiated Logout 1.0 §2

  • internal/endsession.TestHandler_BadIDTokenSignaturea tampered hint is refused with 400 before its aud can select the client whose post-logout URI is honoured

CVE-2026-71575Apache CXF

the max_age check had a unit mismatch and an inverted comparison

OIDC Core 1.0 §3.1.2.1

  • internal/authorizeendpoint.TestEndToEnd_MaxAgeIsMonotoneAtEveryAcceptedValue
  • internal/authorizeendpoint.TestEndToEnd_MaxAgeZeroAlwaysReauthenticates

CVE-2026-92227Joomla

a remember-me session was issued before MFA completed

OIDC Core 1.0 §2 (acr semantics)

  • internal/authorizeendpoint.TestEndToEnd_MFAWithholdsSessionUntilSecondFactorCompletesno session cookie or record exists between the password and TOTP steps

Token exchange and custom grants ​

4 advisoriespinned by a regression test

CVE-2026-1486Keycloak

failed custom-grant preconditions still issued tokens

RFC 6749 §4.5

  • internal/tokenendpoint.TestCustomGrant_NoTokenEscapesAFailedPrecondition

CVE-2026-9704Keycloak

token exchange silently dropped delegation parameters and proceeded

RFC 8693 §2.1

  • test/scenarios.TestTokenExchange_DelegationParametersAreNeverSilentlyDropped

CVE-2026-97846token exchange

token exchange dropped the mTLS binding and widened scope

RFC 8693 §2.1

  • test/scenarios.TestScenario_TX_020_MTLSBoundSubjectRequiresMatchingCert
  • test/scenarios.TestScenario_TX_009_ScopeInflationRejectedbinding and scope are tested separately

CVE-2026-109374ZITADEL

token exchange skipped its impersonation check

RFC 8693 §2.1

  • test/scenarios.TestScenario_TX_011_PolicyErrorPreservedVerbatimthe embedder's exchange policy is mandatory and always consulted
  • test/scenarios.TestScenario_TX_009_ScopeInflationRejected

Back-channel authentication (CIBA) ​

1 advisorypinned by a regression test

CVE-2026-109082Keycloak

a client not allowed to use CIBA could still start a back-channel request

CIBA Core 1.0 §13

  • internal/cibaendpoint.TestServe_RejectsClientWithoutCIBAGrantunauthorized_client

Multi-factor authentication (TOTP / step-up) ​

28 advisoriespinned by a regression test

GHSA-9r3w-4j8q-pw98cal.com

providing a TOTP code skipped the password check entirely — TOTP step ran without primary-factor proof

RFC 6238 / OIDC Core §2 (acr semantics)

  • internal/authn.TestLoginFlowTOTPRequiresPrimaryorchestrator gate
  • internal/authn/totp.TestAuthenticator_BeginRequiresSubject
  • internal/authn/totp.TestAuthenticator_ContinueRequiresSubjectadapter gate

GHSA-5jfq-x6xp-7rw2Keycloak

second-factor bypass — same structural class, covered by the same two-layer mitigation (orchestrator step ordering + adapter Subject-required gate)

RFC 6238 / OIDC Core §2

  • internal/authn.TestLoginFlowTOTPRequiresPrimary
  • internal/authn/totp.TestAuthenticator_BeginRequiresSubject
  • internal/authn/totp.TestAuthenticator_ContinueRequiresSubject

CVE-2026-37982Keycloak

required-action email links had broken one-time-use semantics; an intercepted WebAuthn / TOTP enrollment link could be replayed to enroll an attacker authenticator

one-time credential invariant / OIDC Core §2 (amr semantics)

  • internal/authn/emailotp.TestContinueVerifyReplayRejected

CVE-2026-9798Keycloak

CIBA authentication flow bypassed the brute-force lockout used by interactive login by receiving a separate credential-attempt budget

CWE-307 / cross-factor lockout invariant

  • internal/authn/lockout.TestCrossFactorPivotTriggersLockout

CVE-2026-33473CVE-2025-43798CVE-2021-43177Vikunja / Liferay / devise-two-factor

a TOTP code could be replayed in its current or trailing time step

RFC 6238 §5.2

  • internal/authn/totp.TestVerify_ReplaysSameStepRejected

CVE-2026-20779GHSA-gx3v-q759-g323

TOTP replay or failure handling bypassed the lockout / replay gate

RFC 6238 / cross-factor lockout invariant

  • internal/authn/totp.TestVerify_LocksAtThirtyFailures
  • internal/authn/totp.TestVerify_ReplaysSameStepRejected
  • op/store/contract.totpAcceptReplay
  • op/store/contract.totpConcurrentAcceptlockout, replay, and store TOCTOU are covered

CVE-2026-96445MFA / proxy trust

an untrusted forwarded header altered client-IP identity, or a stale MFA enrollment was accepted

MFA enrollment invariant / proxy trust boundary

  • internal/proxy.TestResolve_UntrustedRemote_IgnoresForwardedHeaders
  • op/store/contract.totpAcceptStaleEnrollmentproxy trust and stale-enrollment cases are separate

CVE-2026-28787OneUptime

WebAuthn ceremony challenge replay

WebAuthn Level 3 §13.4.3

  • internal/authn.TestTickFactorScratchRoundtrip
  • internal/authn/passkey.TestAuthenticator_ChallengeComesOnlyFromServerHeldState

CVE-2026-6856Keycloak

allow-listed AAGUID was accepted without vouched direct attestation

WebAuthn Level 3 §6.5 / §7.1

  • internal/authn/passkey.TestAAGUIDAllowlistOnlyDecidesOnAVouchedAAGUID
  • internal/authn/passkey.TestAAGUIDAllowlistRequiresATrustedAttestationChain

CVE-2026-73313passkey

a passkey assertion used an unregistered credential

WebAuthn Level 3 §7.2

  • internal/authn/passkey.TestCeremony_UnregisteredCredentialIsRefused

CVE-2026-72780GHSA-wg23-69c2-gjc8

passkey sign-counter and user-verification state were lost across updates

WebAuthn Level 3 §7.2

  • internal/authn/passkey.TestAuthenticator_UVBitTravelsOnResult
  • internal/authn/passkey.TestPersistCredentialReverseCompletionDoesNotRewindUV and counter persistence are tested separately

GHSA-6hxq-p678-4hr2passkey attestation

an untrusted attestation AAGUID satisfied an allow-list

WebAuthn Level 3 §6.5 / §7.1

  • internal/authn/passkey.TestAAGUIDAllowlistRequiresATrustedAttestationChain

CVE-2026-22751Spring Security

concurrent use of one-time email code yielded multiple successful authentications

one-time credential invariant

  • internal/authn/emailotp.TestContinueVerify_ConcurrentSubmissionsOfOneCodeYieldOneSuccess

CVE-2026-48505GHSA-mc5j-f6wx-h9qh

concurrent recovery-code redemption yielded more than one success

one-time credential invariant

  • op/storeadapter/inmem.TestRecoveryStore_ConsumeRaceSingleWinner
  • op/store/contract.recoveryConcurrentConsume

CVE-2026-100679stoatchat

an MFA ticket was not bound to the first factor's user

OIDC Core 1.0 §2

  • internal/authn.TestTick_LaterFactorCannotRebindSubjectends the chain with ErrSubjectMismatch; control: TestTick_FirstFactorMayReplaceInheritedSubject

CVE-2026-73278Gitea

a sign-in path that reused an existing session skipped the second-factor requirement

OIDC Core §3.1.2.3

  • internal/authorizeendpoint.TestEndToEnd_SessionReuseStillEvaluatesLoginFlowRulesLoginFlow rules and the Decider run before such a mint; prompt=none answers interaction_required

CVE-2026-61630nginx-ignition

one TOTP code was accepted more than once within its window

RFC 6238 §5.2

  • internal/authn/totp.TestVerify_ReplaysSameStepRejected
  • op/store/contract.totpAcceptEarlierstore contract: an earlier step is refused

CVE-2026-58271sync-in

CVE-2026-105835PLANKA

CVE-2026-111356MacCMS

TOTP or recovery-code brute force through a path with no attempt limit

CWE-307

  • op.TestProjectBuiltinStep_AttachesLockoutCounterevery built-in credential step, including the password, shares one per-subject counter; wired by WithAuthnLockoutStore or the WithStore value's AuthnLockouts()
  • internal/authorizeendpoint.TestEndToEnd_PasswordLockout_LockedMatchesWrongPassword
  • internal/authn/totp.TestVerify_LocksAtThirtyFailures
  • internal/authn/recovery.TestAuthenticator_AttemptBudgetTracksRecordedFailures

CVE-2026-91982Vikunja

the TOTP secret was exposed after enrolment

CWE-200

  • op/totpkit.TestNewEnrolment_AADBindsSubjectthe store holds only ciphertext, and the sealed seed opens only for its subject

CVE-2026-111911phpMyFAQ

WebAuthn registration validated no challenge and bound no subject

WebAuthn Level 3 §7.1

  • op/passkeykit.TestFinish_RejectsForeignChallenge
  • op/passkeykit.TestFinish_RejectsSubjectMismatchauthenticating the user before registration is the embedder's job

CVE-2026-55167LAM

the WebAuthn challenge stayed valid after processing

WebAuthn Level 3 §13.4.3

  • internal/authn.TestPasskeyChallengeIsSingleUseAfterSoftFailure
  • internal/authn.TestPasskeyChallengeRetiredAfterHardFailure

CVE-2026-107276MISP

CVE-2026-82761AshAuthentication

a race let one email code or magic link finish two logins (this OP has no magic link; its single-use credentials share the same one-winner contract)

one-time credential invariant

  • internal/authn/emailotp.TestContinueVerify_ConcurrentSubmissionsOfOneCodeYieldOneSuccess
  • op/store/contract.emailOTPConcurrentConsume
  • op/store/contract.recoveryConcurrentConsume

CVE-2026-110862Better Auth

an OAuth state value was accepted as a magic-link token

one-time credential invariant

  • internal/authn.TestSingleUseSecretNamespacesAreDisjointrecovery codes, email-OTP codes and StateRefs never redeem as one another

DPoP / sender-constrained tokens ​

2 advisoriespinned by a regression test

CVE-2026-54431liboauth2

DPoP proof accepted a jwk header that embedded private EC key material instead of a public-only key

RFC 9449 §4.3 step 7

  • internal/dpop.TestVerify_RejectsPrivateKeyInJWKHeader

CVE-2026-41707DPoP replay marker

a DPoP replay marker was evicted before its expiry

RFC 9449 §11.1 / store contract

  • internal/dpop.TestVerify_ReplayAcrossFullIatWindowverifier window tested; Redis noeviction deployment remains a requirement

mTLS client identity ​

3 advisoriespinned by a regression test

GHSA-2ffq-g2xg-c22pEcho

forwarded scheme headers were trusted from any peer

RFC 7239 §8

  • op.TestWrapWithTrustedProxy_IgnoresUntrustedHeaders
  • internal/proxy.TestResolve_UntrustedRemote_IgnoresForwardedHeadersforwarding headers are honoured only from the configured trusted proxies

CVE-2026-22747CVE-2026-47838Spring Security

text parsing of an X.509 subject DN allowed crafted attributes to collide with another identity

RFC 8705 §2.1

  • internal/mtls.TestVerifyTLSClientAuth_SubjectDN_CraftedNameDoesNotCollideOnceRendered
  • internal/mtls.TestVerifyTLSClientAuth_SubjectDN_MultiValuedMatcherDoesNotFlatten

Dynamic Client Registration ​

7 advisoriespinned by a regression test

CVE-2026-9705another OP

a registration access token re-enabled an administrator-disabled client

RFC 7592

  • internal/registrationendpoint.TestManage_OperatorDeletedClientRATCannotRecreatethis OP has no disabled state; an operator removes a client by deleting it, and the old token gets 401 and cannot recreate it

CVE-2026-22752Spring Authorization Server

unvalidated client metadata caused stored XSS, authority widening, or SSRF

RFC 7591 §2

  • internal/registrationendpoint.TestDCR_ClientMetadataIsTreatedAsAttackerInput
  • op/interaction.TestHTMLDriver_ClientDisplayNameCannotBecomeMarkup

CVE-2026-61466dynamic client registration

DCR accepted an unknown scope

RFC 7591 §2

  • internal/registrationendpoint.TestRegister_RejectsScopeNotInRegistrythe advisory's public-client-shape case is not covered by this test

GHSA-xwmw-prc4-v3crdynamic client registration

DCR metadata reached HTML without escaping, and an untrusted software statement was accepted

RFC 7591 §2 / §3.1.1

  • internal/registrationendpoint.TestRegister_MetadataValidation_4xx
  • op/interaction.TestHTMLDriver_ConsentClientNameEscapedXSS and software-statement validation; no broad trust-chain claim

GHSA-c73q-w75p-j82vAuthlib

an RFC 7592 registration access token was never matched to the target client

RFC 7592 §2

  • internal/registrationendpoint.TestManage_Read_4xxthe token is looked up by the client_id in the path for GET, PUT and DELETE

CVE-2026-105306Keycloak

DCR stored security-sensitive client attributes supplied by the caller

RFC 7591 §2

  • internal/registrationendpoint.TestRegister_InternalClientAttributesNotWritablemetadata is an explicit allow-list

CVE-2026-107623Keycloak

the DCR response omitted a setting, so a read-modify-write lost it

RFC 7592 §2.2

  • internal/registrationendpoint.TestManage_ReadModifyWriteIsLosslessGET, PUT the body back, GET again: identical responses, unchanged stored client

JARM / response signing ​

2 advisoriespinned by a regression test

CVE-2023-6927Keycloak

response_mode=form_post.jwt open redirect that bypassed the fix for CVE-2023-6134; JARM responses are signed with one fixed algorithm and written through the escaping form_post writer

FAPI 2.0 Message Signing §5.4.1

  • internal/jarm.TestSigner_AlgIsES256_Structural

CVE-2023-6134Keycloak, parent

redirect_uri validation bypass that the form_post.jwt variant later circumvented; tracked via 6927

RFC 6749 §3.1.2.3

  • internal/jarm.TestSigner_AlgIsES256_Structural

Error response surfaces (redirect / form_post) ​

2 advisoriespinned by a regression test

The authorize endpoint emits errors over two surfaces — a redirect with query parameters and an auto-submitting form_post HTML page. Both must escape RP-supplied bytes so a hostile redirect_uri or error_description cannot inject markup or open-redirect chains.

GHSA-27gc-wj6x-9w55Keycloak, 2024

error_description reflected into HTML error pages without escaping (CWE-79 / CWE-601) — phishing / open-redirect chains. Two-layer mitigation: (1) error_description is a closed catalogue of hardcoded sentinels — RP bytes never reach the field directly; (2) on the wire, url.Values.Encode percent-encodes the redirect surface and html.EscapeString escapes both action= and value= on the form_post surface

RFC 6749 §4.1.2.1 / RFC 9700 §4.11.2 / CWE-79

  • internal/jarm.TestWriteFormPost_EscapesRedirectAndJWT
  • internal/authorizeendpoint.TestEmitPlainResponse_EncodesHostileBytes_NoXSS
  • internal/authorizeendpoint.TestEmitPlainResponse_StripsControlBytes
  • internal/jarm.TestWriteParamsFormPost_EscapesValues

CVE-2026-44203GHSA-fq9h-c788-fx73

form_post output failed to escape echoed values

RFC 6749 §4.1.2.1 / RFC 9700 §4.11.2 / CWE-79

  • internal/jarm.TestWriteFormPost_EscapesRedirectAndJWT
  • internal/jarm.TestWriteParamsFormPost_EscapesValuesHTML escaping on both writers

Operator observability (silent failure on revoke) ​

2 advisoriespinned by a regression test

GHSA-7mqr-2v3q-v2wmory/fosite

/revoke silently swallowed storage errors — RFC 7009 §2.2 still requires a wire 200, but operators had no observable signal that revocation actually failed. The library keeps the wire 200 and additionally emits token.revoke_failed on every non-NotFound store fault so SOC tooling can detect the silent-failure class

RFC 7009 §2.2

  • internal/revokeendpoint.TestHandler_RefreshToken_StoreFault_EmitsAudit

CVE-2026-55221audit logging

raw authorization code leaked into audit logs in redeemable form

audit redaction invariant

  • internal/authorizeendpoint.TestEndToEnd_AuditNeverCarriesRawAuthorizationCode
  • internal/audit.TestSlog_RedactsExtrasWithoutWrappercode digest and extra-field redaction

Device authorization grant ​

1 advisorypinned by a regression test

GHSA-3jp2-3mrg-2vxcoauthlib

a device_code token was issued without validating the device_code

RFC 8628 §3.4

  • test/scenarios.TestScenario_DEV_024_TokenRequestMissingDeviceCode
  • test/scenarios.TestAdvisory_UnknownDeviceCodeMintsNoTokena never-issued code mints nothing and answers expired_token by design
  • test/scenarios.TestScenario_DEV_027_TokenRequestClientMismatcha code issued to another client mints nothing

DoS / parsing safety ​

Fuzz harnesses across the JOSE / endpoint surface keep parsing panic-free against crafted inputs. The endpoint harnesses below exercise their unauthenticated form envelopes; they do not reach authenticated token or JWE decryption paths.

SurfaceFuzzer or testCVE class kept out
JOSE parseinternal/jose.FuzzJOSEParseCWE-400 / oversized compact JWS and algorithm parsing; ParseSigned only, with no JWE-decryption claim
JWE decryptioninternal/jose.TestDecrypt_ZipBombResistance
internal/jose.TestDecrypt_PlaintextSizeCap_OverLimit		CVE-2024-29371, CVE-2025-62706 (bounded decompressed plaintext)
PAR endpoint bodyinternal/parendpoint.FuzzPARFormBodybounded unauthenticated form-envelope parsing; no JWE coverage
Introspection endpoint bodyinternal/introspectendpoint.FuzzIntrospectFormBodybounded unauthenticated form-envelope parsing; no JWE coverage
Revocation endpoint bodyinternal/revokeendpoint.FuzzRevokeFormBodypanic immunity for the unauthenticated form envelope; no JWE coverage

FuzzJOSEParse exercises only jose.ParseSigned, which parses compact JWS input and never enters JWE decryption. A provider without WithEncryptionKeyset rejects JWE-shaped request objects, while a provider with one decrypts nested compact JWE request objects before verifying the inner JWS. TestDecrypt_ZipBombResistance and TestDecrypt_PlaintextSizeCap_OverLimit pin the direct JWE plaintext bounds. Input shape alone is not sufficient to claim coverage of a dependency advisory.

Dependency advisories (class level only) ​

7 advisorieslisted at class level only

The advisory registry files these against FuzzJOSEParse, which parses compact JWS only and never enters JWE decryption. None of them has a test of the dependency's own behaviour here; they are listed so the limit is visible. Dependency fixes arrive through govulncheck and version bumps.

GHSA-78h2-9frx-2jm8go-jose

JWE decryption panic on crafted input

internal/jose.FuzzJOSEParse keeps ParseSigned panic-free; JWE decryption is not exercised

GHSA-c6gw-w398-hv78go-jose

parse DoS on pathological JSON

the same no-panic contract; no resource-bound assertion

GHSA-c5q2-7r4c-mv6ggo-jose

compression amplification, same cluster as CVE-2024-29371

ParseSigned has no compression path; the decrypt-side bound is the CVE-2024-29371 row above

GHSA-pvcr-v8j8-j5q3jwx

panic in JSON-form parsing

internal/jose.TestParseSigned_RejectsJSONSerialisationShapes pins refusal at the compact-only boundary, not the dependency's JSON parser

GHSA-hj3v-m684-v259GHSA-7f9x-gw85-8grfjwx

JWE compression DoS and malicious JWE parameters

compact-only ParseSigned never reaches JWE parameters; no direct test

GHSA-rm8v-mxj3-5rmqjwx

padding-oracle possibility in CBC-mode JWE

no direct test

Out of scope — owned by the embedder ​

36 advisoriesout of scope for an OP

These advisories were reviewed and excluded: the affected surface is either absent from an OP or belongs to the application that embeds the library. They are not pinned by a test and are not counted as covered.

GHSA-q84f-53jg-9ppmbetter-auth

the device approval page did not show the requesting client or its scopes

The OP serves no device verification page. The embedder builds it on op/devicecodekit, whose ApproveUserCode godoc requires the prompt to show the client and scopes from FindByUserCode.

GHSA-gr79-9v6v-gc9rdex

GHSA-q8hq-4h99-fj7xKeycloak

CVE-2026-53622reverse proxy

TLS 1.0 / 1.1 served, TLS renegotiation DoS, SNI routing that bypassed an mTLS requirement

The library does not own the HTTP server, terminate TLS, or route by SNI. TLS configuration is the embedder's; see Library posture.

CVE-2026-4874

CVE-2026-1518Keycloak

CVE-2026-54430liboauth2

SSRF through a token-endpoint URL, a CIBA notification endpoint, or an AWS-ALB JWKS resolver

Egress control is the embedder's network boundary, and the AWS-ALB and notification-callback surfaces do not exist here. The jwks_uri SSRF class that does exist is covered by CVE-2026-1180.

GHSA-3gx8-q682-38mxroadiz

GHSA-c5mf-xmp2-59rcAuthlib

GHSA-h2r5-x5m7-3935python-social-auth

an RP never stored, validated, or bound to the browser session the ID token nonce

Nonce validation on the callback is the RP's. The OP mints the nonce into the ID token.

GHSA-wxw3-q3m9-c3jrBetter Auth

CVE-2026-61687Hatchet

CVE-2026-62322python-social-auth

CVE-2026-84178Apache Camel

CVE-2026-84312Nginx-UI

CVE-2026-108738Traccar

login CSRF: an RP skipped, mis-bound, or defaulted its OAuth state

State generation and callback verification are the RP's. The OP echoes state verbatim (RFC 6749).

CVE-2026-79650Apache CXF

an RP used an attacker-controlled state as the post-login redirect

Post-login navigation is the RP's. The OP redirects only to registered redirect_uri and post_logout_redirect_uri values.

CVE-2026-62367Vikunja

CVE-2026-106460Backstage

CVE-2026-63472Vendure

CVE-2026-92161FriendsOfFlarum OAuth

an RP linked an external login to a local account by email while ignoring email_verified

Account linking is the RP's. The OP's part is to emit email_verified truthfully from the embedder's claims source.

CVE-2026-94276Apache APISIX

a resource server accepted an introspection result active for another issuer

Issuer pinning on the introspection result is the resource server's. This OP serves one issuer and names it in the response.

CVE-2026-54460OpenReception

CVE-2026-105212ZITADEL

CVE-2026-111949miniOrange

CVE-2026-84313Nginx-UI

passkey or TOTP enrolment for an unauthenticated or unrelated subject, or without re-authentication

The OP exposes no enrolment endpoint and its login chain has no enrolment step. passkeykit and totpkit take the subject from the embedder, who must authenticate the user first (op/passkeykit.TestFinish_RejectsSubjectMismatch pins the subject binding).

CVE-2026-100709Froxlor

a remembered-2FA token that stored only a user ID

The OP keeps no remembered-device or remembered-factor record; device trust comes from the embedder's RiskAssessor.

GHSA-qj3q-235g-qr6wZITADEL

CVE-2026-105485Devolutions

CVE-2026-105305Keycloak

device-code approval without user entry or consent, a replayed verification link, or a device grant that ignored the minimum authentication level

The /device verification page is the embedder's. The OP only issues verification_uri_complete; approval is an explicit devicecodekit.ApproveUserCode call that takes the subject and auth_time from the embedder.

CVE-2026-49264oauthlib

a JSONP callback reflected into a revocation response

No endpoint has a JSONP mode; revocation answers with JSON or an empty 200.

CVE-2026-102275PyJWT

an OKP JWK whose x and d disagreed

The OP never imports private JWKs. Its keys arrive from the embedder as Go key values, and inbound JWKs are public only.

CVE-2026-9800CVE-2026-9799Keycloak

authorization bypass through the Policy Enforcer access-denied path, and a UMA permission-ticket bypass

Resource-server policy enforcement is the resource server's, and UMA is not implemented here.

GHSA-68wq-phq7-p2vgSilverStripe MFA

the password-reset flow issued a session before MFA completed

Password reset is part of the embedder's account management. The OP has no password-reset flow.

GHSA-m9hp-7r99-94h5dex

a self-written SAML XML parser

SAML is not implemented; this is an OP only.

What this list deliberately does not include ​

  • CVEs against this library. This matrix is not a live advisory ledger; if a CVE is filed, it is handled through SECURITY.md and Reporting a security issue, not tracked as a point-in-time count here.
  • Dependency and runtime defects. These are tracked through govulncheck in CI and resolved by version bump. An entry appears above only when a targeted test demonstrates the relevant library contract; input shape or a disabled optional feature is not treated as coverage. The advisories with class-level registry status are listed under Dependency advisories. Go standard-library fixes (for example GO-2026-5856, an Encrypted Client Hello leak) are handled through the Go baseline and toolchain declared by the core module; check the core go.mod when reviewing that boundary.
  • Tracked but not yet covered advisories. An advisory the source repository's registry holds in tracking status stays out of this page until a concrete test pins the contract; it then appears in a covered section.
  • Theoretical attacks without a published CVE. A test motivated purely by a spec section (e.g. RFC 8725 §3.x) is still in the codebase, but won't appear here unless a CVE pins the class to a named defect somewhere in the ecosystem.

Reading the bigger picture ​

The CVE-driven tests sit alongside three other layers of regression material:

  1. Spec scenarios — test/scenarios/ (in the repo) catalogues OIDC / OAuth / FAPI behaviours from the spec text directly, regardless of whether a CVE exists.
  2. OFCS conformance harness — see OFCS conformance status. The OpenID Foundation's certified test suite drives the public surface end-to-end against the FAPI 2.0 plans.
  3. Fuzz harnesses — listed above. Their seed corpora run as ordinary tests on every PR; make fuzz explores beyond the seeds.

If you find a CVE class this library should pin and doesn't, please open an issue or follow the disclosure flow for anything that would itself be a vulnerability to discuss in public.