AIKIDO-2025-10522

TL;DR

Affected versions are vulnerable to Denial of Service (DoS) due to inefficient handling of malicious ID tokens. Specifically, the package attempts to parse claims from the token before validating it, which allows an attacker to supply a specially crafted invalid token that triggers excessive memory allocation. This can lead to resource exhaustion and potential application crashes. The updated logic addresses this by validating the ID token before attempting to parse claims, reducing the risk of exploitation through malicious input.