oidcc Auth Bypass Lets Attackers Impersonate Users

The Erlang Ecosystem Foundation (ERLEF) published an advisory for CVE-2026-75759, an improper cryptographic signature verification flaw in oidcc, the Elixir library that is effectively the standard implementation of OpenID Connect (OIDC) authentication in the ecosystem. An unauthenticated attacker can exploit the bug to impersonate any user an identity provider knows about.

What Is Broken

OpenID Connect authentication relies on ID tokens: signed JWTs that an identity provider issues to assert a user’s identity. The oidcc library failed to properly validate the algorithm specified in an encrypted ID token or a JSON Authorization Request Mode (JARM) response. An attacker who can supply one of those objects, with an attacker-controlled algorithm field, can bypass signature verification entirely and present themselves as an arbitrary user.

Algorithm confusion attacks on JWT libraries are not a new class. They have surfaced repeatedly across implementations since at least 2015. The reason this particular disclosure matters is scope: oidcc is the de facto OIDC implementation in Elixir. Elixir applications delegating authentication to providers such as Keycloak, Auth0, Azure AD, Okta, or Google via oidcc are in scope for this vulnerability.

The ERLEF advisory is the canonical source for the affected version range and the patched release.

What to Do

Check your mix.exs and mix.lock for the oidcc dependency. Update to the patched version the advisory specifies and redeploy. If your environment uses a locked Hex package set or a vendor-provided base image, unblocking this update takes priority.

Session tokens issued before the patch are not automatically invalidated. Whether to force a full re-authentication cycle for active sessions depends on your threat model. If you have reason to believe exploitation has already occurred in your environment, treat active sessions as compromised and rotate.

If you are running oidcc behind an API gateway or reverse proxy that performs independent token validation before requests reach the library, your exposure window is narrower. “Narrower” is not “zero.” Patch regardless.

Priority

Unauthenticated user impersonation via authentication-layer bypass sits near the top of the impact scale. If oidcc handles production authentication in your stack, treat this as an emergency update. Read the ERLEF advisory, verify your version, and patch.

For broader context on authentication bypass risks in web applications, see our earlier coverage of the rConfig auth bypass and Russian threat clusters exploiting OAuth flows to hijack user accounts.