CVE-2026-81829
Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.
| CWE | CWE-22 |
| Vendor | red hat |
| Product | red hat build of quarkus 3.27.5.sp2 |
| Published | Sep 17, 2026 |
| Last Updated | Oct 9, 2026 |
Get instant alerts for red hat red hat build of quarkus 3.27.5.sp2
Be the first to know when new medium vulnerabilities affecting red hat red hat build of quarkus 3.27.5.sp2 are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N