CVE-2026-66884

Name of the Vulnerable Software and Affected Versions oidcc plug versions 0.2.0-beta.1 through 0.4.9

Description A Cross-Site Request Forgery issue in the Oidcc.Plug.AuthorizationCallback module allows an attacker to force a victim's browser to complete an unauthorized authorization flow. The Oidcc.Plug.AuthorizationCallback.call/2() function fails to reject callback requests that lack an Oidcc.Plug.Authorize session, instead applying permissive defaults that bypass security checks for nonce, state, PKCE, peer IP, and user agent. Additionally, the check state/2() function accepts requests without a state when a verifier is present. An attacker can use an authorization code from their own account to sign a victim into the attacker's account or, in cases where a single callback is used for both signing in and linking accounts, achieve full account takeover by linking the attacker's account to the victim's.

Recommendations Update oidcc plug to version 0.5.0 or later. As a temporary workaround, insert a plug before Oidcc.Plug.AuthorizationCallback that rejects requests if the Oidcc.Plug.Authorize session or the state query parameter is missing.