PT-2020-16372
CVE-2020-26244
·
Published
2020-12-02
·
Updated
2026-10-04
Description by
CVSS 4.0
7.6
HighMetricsAV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Python oic versions prior to 1.2.1
Description
The issue affects client implementations using the Python oic library, a Python OpenID Connect implementation. There are several related cryptographic issues:
- The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg.
- JWA
nonealgorithm was allowed in all flows. oic.consumer.Consumer.parse authzreturns an unverified IdToken, with verification left to the implementator's discretion.- The
iatclaim was not checked for sanity, allowing it to be in the future.
Recommendations
For versions prior to 1.2.1, update to version 1.2.1 to resolve the issues.
As a temporary workaround, consider disabling the use of the JWA
none algorithm in all flows until the update is applied.
Restrict access to the oic.consumer.Consumer.parse authz function to minimize the risk of exploitation until the update is applied.
Avoid using the iat claim without proper sanity checks until the update is applied. Found an issue in the description? Have something to add? Feel free to write us 👾