CVE-2026-59096 Dapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-Host
Attackers can poison OIDC discovery documents via X-Forwarded-Host injection, allowing acceptance of forged JWTs and bypassing authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59096?
CVE-2026-59096 is a high-severity authentication bypass vulnerability in dapr, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-configuration document from the request Host, honoring an attacker-controlled X-Forwarded-Host header without validation when no allowed-hosts list is configured (the default), and serves the document with a one-hour public cache lifetime. A remote unauthenticated attacker can poison the discovery document so relying parties performing dynamic (unpinned) discovery fetch the JWKS from an attacker-controlled server, causing attacker-signed JWTs to be accepted. Exploitation requires the OIDC server enabled without a configured jwt-issuer or oidc-allowed-hosts.
Weakness: CWE-346
Which versions are affected by CVE-2026-59096?
How do I fix CVE-2026-59096?
Change a configuration setting.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-59096 being exploited?
There is no known exploitation of CVE-2026-59096 in the wild and no public exploit code.
Sources
Also known as GHSA-q8cr-74p8-486p, MINI-2f7p-4qc2-w69j, MINI-8r2q-3vqr-vg9w, MINI-g6p8-27x7-mhvr, MINI-g9x5-gxxj-c8qv, MINI-jf3q-wq68-g3g7 and 7 more.