CVE-2026-117656

Name of the Vulnerable Software and Affected Versions assent versions 0.1.25 through 0.3.1

Description An unauthenticated remote attacker can impersonate other users by manipulating the user parameter during the Sign in with Apple authorization callback. The issue occurs because the Assent.Strategy.Apple.callback/2 function in lib/assent/strategies/apple.ex decodes the user parameter, which is controlled by the client and not signed by Apple. Subsequently, the fetch user/2 function merges this unverified data over the claims of the verified ID token, allowing the unverified values to overwrite critical claims such as sub and email. Consequently, the normalize/2 function marks these attacker-supplied identity fields as verified, leading applications to authorize accounts based on fraudulent information.

Recommendations Update assent to version 0.3.2. As a temporary workaround, remove the user parameter from the callback parameters using Map.delete(params, "user") before passing them to the Assent.Strategy.Apple.callback/2 function.