{"id":"CVE-2026-59096","summary":"Dapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-Host","details":"Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-configuration document from the request Host, honoring an attacker-controlled X-Forwarded-Host header without validation when no allowed-hosts list is configured (the default), and serves the document with a one-hour public cache lifetime. A remote unauthenticated attacker can poison the discovery document so relying parties performing dynamic (unpinned) discovery fetch the JWKS from an attacker-controlled server, causing attacker-signed JWTs to be accepted. Exploitation requires the OIDC server enabled without a configured jwt-issuer or oidc-allowed-hosts.","modified":"2026-07-16T03:31:00.546120377Z","published":"2026-07-02T19:41:40.984Z","database_specific":{"cwe_ids":["CWE-346"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59096.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59096.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59096"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/dapr-oidc-discovery-issuer-and-jwks-uri-injection-via-unvalidated-x-forwarded-host"},{"type":"REPORT","url":"https://github.com/dapr/dapr/pull/10027"},{"type":"REPORT","url":"https://github.com/dapr/dapr/pull/10028"},{"type":"REPORT","url":"https://github.com/dapr/dapr/pull/10029"},{"type":"PACKAGE","url":"https://github.com/dapr/dapr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dapr/dapr","events":[{"introduced":"755b4763223f066f75876dccd34e3be3aea476e7"},{"last_affected":"7c4f540efa3e6f768a45010f2fc0d4b4c287cac3"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"1.17.0"},{"last_affected":"1.17.0"},{"introduced":"1.18.0"},{"last_affected":"1.18.0"}]}}],"versions":["1.17.0","1.18.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59096.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}