CVE-2026-66883

Name of the Vulnerable Software and Affected Versions oidcc plug versions 0.1.0-alpha.3 through 0.4.9

Description Improper handling of case sensitivity in the Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense-in-depth control against the replay of stolen sessions. The function Oidcc.Plug.Authorize.call/2 attempts to read the user agent using get req header(conn, "User-Agent"). Because Plug lowercases incoming header names and get req header/2 performs an exact match without normalization, the mixed-case lookup fails and writes nil into the session. Subsequently, Oidcc.Plug.AuthorizationCallback.call/2 treats a nil user agent as having nothing to compare, allowing the check to pass unconditionally. This allows an authorization callback to be completed from a different user agent than the one that initiated the flow, even when check useragent is set to true. This issue primarily affects the ability to hinder the use of exfiltrated session cookies replayed from different clients, although CSRF/state, nonce, and PKCE checks remain functional.

Recommendations Update oidcc plug to version 0.5.0 or later.