A newly disclosed flaw in erlef's oidcc, an Elixir OpenID Connect library, lets an unauthenticated attacker impersonate any user by sending an encrypted ID token or JARM response that skips the required inner signature. The OpenID Connect spec expects encrypted tokens to be signed first and then encrypted, but oidcc doesn't enforce that nesting, so a forged unsigned payload can pass verification. Applications relying on the library for authentication should update as soon as a fix is available.
// source: nvd.nist.gov ↗