Mathias Polligkeit

**Name of the Vulnerable Software and Affected Versions** woylie doggo versions 0.1.0 through 0.14.7 **Description** Reflected Cross-site Scripting (XSS) occurs when the `Doggo.normalize value/2` function in `lib/doggo.ex` returns date field values wrapped in a `{:safe, ...}` marker. This marker instructs Phoenix.HTML to emit the content verbatim without escaping, allowing the value to reach the `value` attribute of the rendered `<input>` element unchanged. This affects applications rendering `<.field type="date">` using user-controlled parameters during a Phoenix form round-trip when validation fails and the submitted value is re-rendered. The payload is limited to ten bytes, which is sufficient to terminate the attribute and open an element or attach a short event handler, but insufficient for inline scripts. **Recommendations** Update to version 0.14.8 or later. Use `type="text"` instead of `type="date"` for fields receiving user-submitted parameters. Pass an explicit value already validated as an ISO 8601 date to the component instead of allowing it to read directly from the form field.

**Name of the Vulnerable Software and Affected Versions** oidcc plug versions 0.1.0-alpha.3 through 0.4.9 **Description** Improper handling of case sensitivity in the `Oidcc.Plug.Authorize` module renders the user agent session binding inert, removing a defense-in-depth control against the replay of stolen sessions. The function `Oidcc.Plug.Authorize.call/2` attempts to read the user agent using `get req header(conn, "User-Agent")`. Because Plug lowercases incoming header names and `get req header/2` performs an exact match without normalization, the mixed-case lookup fails and writes `nil` into the session. Subsequently, `Oidcc.Plug.AuthorizationCallback.call/2` treats a `nil` user agent as having nothing to compare, allowing the check to pass unconditionally. This allows an authorization callback to be completed from a different user agent than the one that initiated the flow, even when `check useragent` is set to `true`. This issue primarily affects the ability to hinder the use of exfiltrated session cookies replayed from different clients, although CSRF/state, nonce, and PKCE checks remain functional. **Recommendations** Update oidcc plug to version 0.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** oidcc plug versions 0.2.0-beta.1 through 0.4.9 **Description** A Cross-Site Request Forgery issue in the `Oidcc.Plug.AuthorizationCallback` module allows an attacker to force a victim's browser to complete an unauthorized authorization flow. The `Oidcc.Plug.AuthorizationCallback.call/2()` function fails to reject callback requests that lack an `Oidcc.Plug.Authorize` session, instead applying permissive defaults that bypass security checks for nonce, state, PKCE, peer IP, and user agent. Additionally, the `check state/2()` function accepts requests without a state when a verifier is present. An attacker can use an authorization code from their own account to sign a victim into the attacker's account or, in cases where a single callback is used for both signing in and linking accounts, achieve full account takeover by linking the attacker's account to the victim's. **Recommendations** Update oidcc plug to version 0.5.0 or later. As a temporary workaround, insert a plug before `Oidcc.Plug.AuthorizationCallback` that rejects requests if the `Oidcc.Plug.Authorize` session or the `state` query parameter is missing.