AIKIDO-2026-153522
ueberauth_apple is vulnerable to Authentication Bypass by Spoofing
91
Critical Risk
This Affects:
ueberauth_appleTL;DR
Ueberauth.Strategy.Apple.Token.payload/2 verifies the callback id_token JWT signature against Apple's JWKS but does not validate registered claims such as iss, aud, exp, or iat. handle_callback!/1 then takes uid and email from the unvalidated sub claim. An attacker who obtains any Apple-signed token for the victim's sub can therefore replay an expired token or a token issued to a sibling client in the same Apple developer team and authenticate as that user. The fix validates iss, aud, iat, and exp after signature verification and fails closed when the expected audience cannot be determined.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses ueberauth_apple for Sign in with Apple authentication.
Background info
ueberauth_apple is vulnerable to Authentication Bypass by Spoofing in versions 0.1.0 - 0.6.1.
How to fix this
Upgrade the ueberauth_apple library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant