AIKIDO-2026-36662

TL;DR

Oidcc.Plug.AuthorizationCallback processes an OIDC authorization callback even when no Oidcc.Plug.Authorize session is present on the request. Instead of rejecting the request, it substitutes permissive placeholder values so the nonce, state, PKCE, peer IP, and user agent checks all pass with nothing to compare against, so a callback that carries a valid authorization code but no session is accepted. The fix rejects callbacks that lack an authorization session or a state parameter.