CVE-2026-75759

Name of the Vulnerable Software and Affected Versions oidcc versions 3.2.0-beta.1 through 3.8.9

Description Improper verification of cryptographic signatures allows an unauthenticated attacker to impersonate any user. The issue occurs when the software accepts a JSON Web Encryption (JWE) wrapping unsigned claims as fully validated, failing to require a nested signature as mandated by OpenID Connect Core 1.0 and JARM processing rules. This allows an attacker with the relying party's public encryption key to create tokens with arbitrary sub, iss, and aud values without the provider's signing key. The flaw exists in the verify decrypted token/4 function within oidcc jwt util, where decrypted payloads that are not signed JWS are parsed as plaintext claims. Subsequently, the int validate jwt/4 function in oidcc token returns success based on the JOSE structure type rather than signature verification. Additionally, the validate jarm/3 function in oidcc token is reachable via the browser front channel. This is only exploitable if the OpenID Provider advertises ID token or authorization response encryption and the relying party has an encryption key configured.

Recommendations Update oidcc to version 3.9.0 or later.