CVE-2026-81829: Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.
Other sources
A path traversal and same-origin Server-Side Request Forgery (SSRF) vulnerability was found in the AWS ALB key resolver of SmallRye JWT. When the AWSALB key provider is configured, AwsAlbKeyResolver constructs the verification-key URL by concatenating the configured key location with the attacker-controlled kid value from the inbound, unverified JWT header. The kid value is only checked for null and, optionally, against a configured expected value. Characters such as /, .., ?, and # are not rejected or encoded. An unauthenticated attacker can therefore cause the application server to issue GET requests to arbitrary paths and manipulate query parameters on the configured OIDC/JWKS origin before JWT signature verification. This can be exploited remotely without authentication or user interaction, allowing attackers to read non-public data on the same origin as the configured key endpoint.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using SmallRye JWT with the AWS_ALB key provider configured are exposed. The affected component is AwsAlbKeyResolver, used to verify JWTs signed by AWS Application Load Balancers.
What does an attacker need to exploit it?
An attacker only needs to send an inbound JWT with a crafted kid header; no authentication or user interaction is required. The vulnerable resolver uses the unverified kid value while constructing the key-fetch request.
What can the attacker access through the SSRF?
The attacker can cause GET requests to arbitrary paths on the same origin as the configured key endpoint. This may expose non-public endpoints or internal data reachable on that origin before JWT signature verification occurs.
Is there any configuration that restricts exploitation?
The kid value may optionally be checked against a configured expected value. Otherwise, it is only checked for null, allowing path traversal characters and query-string separators to influence the constructed URL.