oidcc OpenID Connect cryptographic signature verification bypass
Improper cryptographic signature verification in erlef oidcc lets an unauthenticated attacker impersonate any user via an encrypted ID token or JARM response carrying an attacker-controlled algorithm.
- Vendor
- Erlang Ecosystem Foundation
- Product
- oidcc (Elixir OpenID Connect library)
- CVSS
- N/A
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
The Erlang Ecosystem Foundation (ERLEF) CNA disclosed CVE-2026-75759 in oidcc, the standard Elixir library for OpenID Connect (OIDC) authentication. An unauthenticated attacker can supply an encrypted ID token or JSON Authorization Request Mode (JARM) response that carries an attacker-controlled algorithm field, bypassing the library’s signature verification and impersonating any user the identity provider knows about.
Elixir applications that use oidcc to delegate authentication to providers such as Keycloak, Auth0, Azure AD, Google, or Okta are in scope. See the ERLEF advisory for the affected version range and the patched release. Update oidcc and redeploy.
