Improper Cryptographic Signature Verification in erlef oidcc Affects OpenID Connect Implementations

CVE-2026-75759

What is CVE-2026-75759?

The vulnerability in erlef oidcc stems from improper verification of cryptographic signatures, which allows unauthenticated attackers to impersonate any user by exploiting encrypted ID tokens that lack a nested signature. According to OpenID Connect Core 1.0 requirements, encrypted ID tokens must be signed prior to encryption, resulting in a Nested JWT that ensures integrity. However, oidcc accepted unsigned JWE-wrapped claims as legitimate, permitting anyone with access to the relying party's public key to create tokens with arbitrary subject, issuer, and audience values. This flaw compromises the authenticity of tokens, leading to potential unauthorized access. Affected versions of oidcc range from 3.2.0-beta.1 to versions before 3.9.0.

References