Pre-authentication OIDC discovery DoS in asyncio event loop

Executive Summary

This vulnerability involves pre-authentication OIDC discovery and JWKS fetches running synchronously on the asyncio event loop. An unauthenticated request can block the entire service by triggering these operations, which are not handled asynchronously. This leads to event loop stalling and potential denial of service.

Useful 0 Not Useful 0

Detection Guidance

Monitor for stalled asyncio event loops during OIDC discovery or JWKS fetches. Check for prolonged request processing times (up to 40 seconds) or service unavailability after unauthenticated requests. Inspect logs for synchronous blocking operations on the event loop.

Useful 0 Not Useful 0

Impact Analysis

An attacker can send an unauthenticated request with an unsigned JWT to trigger OIDC discovery and JWKS fetches, causing the service to stall for up to 40 seconds. This results in degraded performance or complete unavailability, including failures in Kubernetes liveness probes that may restart pods.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to version 0.9.0 or later. Implement asynchronous handling for OIDC discovery and JWKS fetches using async HTTP clients or threadpool offloading. Add rate limiting at the proxy level to prevent abuse.

Useful 0 Not Useful 0