Improper Handling of Case Sensitivity in Erlang Ecosystem Foundation Oidcc.Plug

CVE-2026-66883

What is CVE-2026-66883?

The improper handling of case sensitivity in the Oidcc.Plug.Authorize module of the Erlang Ecosystem Foundation's oidcc_plug can lead to vulnerabilities in user session management. This issue arises from the way user agent session bindings are processed, where mixed-case user agent headers can interfere with the correct retrieval of session data. Specifically, incoming header names are lowercased during processing, but the actual lookup for the user agent header does not normalize case, resulting in a nil session state. Consequently, this oversight allows for an authorization callback to be completed from a different user agent without detection, effectively nullifying the protective checks that hinder session replay attacks. While this vulnerability does impact the defense-in-depth approach, it does not itself facilitate authorization completion by an attacker; however, it removes a crucial layer of security, potentially exposing deployments to risks associated with session hijacking.

References