oidcc OpenID Connect cryptographic signature verification bypass
Improper cryptographic signature verification in erlef oidcc lets an unauthenticated attacker impersonate any user via an encrypted ID token or JARM response carrying an attacker-controlled algorithm.
- Vendor
- Erlang Ecosystem Foundation
- Product
- oidcc (Elixir OpenID Connect library)
- CVSS
- N/A
- EPSS (exploit probability)
- 0.2%
- Status
- patched
- Published
Is CVE-2026-75759 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-75759 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.2% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
CVE-2026-75759 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The Erlang Ecosystem Foundation (ERLEF) CNA disclosed CVE-2026-75759 in oidcc, the standard Elixir library for OpenID Connect (OIDC) authentication. An unauthenticated attacker can supply an encrypted ID token or JSON Authorization Request Mode (JARM) response that carries an attacker-controlled algorithm field, bypassing the library’s signature verification and impersonating any user the identity provider knows about.
Elixir applications that use oidcc to delegate authentication to providers such as Keycloak, Auth0, Azure AD, Google, or Okta are in scope. See the ERLEF advisory for the affected version range and the patched release. Update oidcc and redeploy.
