OIDC::Lite Vulnerability in Perl Affects ID Token Signature Verification
CVE-2026-13089
Currently unrated
What is CVE-2026-13089?
The OIDC::Lite library for Perl, specifically versions up to 0.12.1, contains a significant vulnerability that allows attackers to bypass ID Token signature verification. This is achieved by exploiting a token-controlled algorithm allowlist during the verification process. When the algorithm is not explicitly pinned, the system derives the algorithm from the token's own header, which allows malicious tokens to pass through without proper signature checks. This enables attackers to authenticate as any user by submitting malicious tokens with tailored claims. To mitigate this risk, developers are advised to pin the algorithm explicitly during verification.
Affected Version(s)
OIDC::Lite 0 <= 0.12.1