Oidcc Plug
Monthly
User-agent session binding in oidcc_plug's OpenID Connect authorization plug is silently rendered inert by a case-sensitivity bug, affecting all versions from 0.1.0-alpha.3 through 0.5.0 that configured check_useragent: true. The authorize plug reads the User-Agent header using a mixed-case key, but Plug normalizes all HTTP header names to lowercase before storage, so the lookup always returns an empty list and nil is written into the OIDC session; the callback plug then treats a stored nil as nothing to compare and returns :ok unconditionally, meaning a stolen session replayed from a different browser or device passes the user-agent check without detection or logging. No public exploit has been identified at time of analysis, and CSRF/state, nonce, and PKCE protections remain fully functional.
Login CSRF in oidcc_plug (versions 0.2.0-beta.1 through 0.5.0) enables an attacker to silently sign a victim into the attacker's own identity provider account by luring the victim to a crafted OIDC callback URL carrying the attacker's authorization code. The root cause is that Oidcc.Plug.AuthorizationCallback.call/2 substitutes permissive defaults (`:any` nonce, `:none` PKCE and state verifiers) when no prior Oidcc.Plug.Authorize session exists instead of rejecting the stateless request outright, causing every downstream security check - nonce, state, PKCE, peer IP, and user-agent binding - to silently pass against nothing. No public exploit code or CISA KEV listing exists at time of analysis; however, the attack primitive is straightforward for any attacker holding an account at the same identity provider.
User-agent session binding in oidcc_plug's OpenID Connect authorization plug is silently rendered inert by a case-sensitivity bug, affecting all versions from 0.1.0-alpha.3 through 0.5.0 that configured check_useragent: true. The authorize plug reads the User-Agent header using a mixed-case key, but Plug normalizes all HTTP header names to lowercase before storage, so the lookup always returns an empty list and nil is written into the OIDC session; the callback plug then treats a stored nil as nothing to compare and returns :ok unconditionally, meaning a stolen session replayed from a different browser or device passes the user-agent check without detection or logging. No public exploit has been identified at time of analysis, and CSRF/state, nonce, and PKCE protections remain fully functional.
Login CSRF in oidcc_plug (versions 0.2.0-beta.1 through 0.5.0) enables an attacker to silently sign a victim into the attacker's own identity provider account by luring the victim to a crafted OIDC callback URL carrying the attacker's authorization code. The root cause is that Oidcc.Plug.AuthorizationCallback.call/2 substitutes permissive defaults (`:any` nonce, `:none` PKCE and state verifiers) when no prior Oidcc.Plug.Authorize session exists instead of rejecting the stateless request outright, causing every downstream security check - nonce, state, PKCE, peer IP, and user-agent binding - to silently pass against nothing. No public exploit code or CISA KEV listing exists at time of analysis; however, the attack primitive is straightforward for any attacker holding an account at the same identity provider.