AIKIDO-2026-36662
oidcc_plug is vulnerable to Cross-Site Request Forgery (CSRF)
21
CVE Score
Low
Cross-Site Request Forgery (CSRF)
TL;DR
Oidcc.Plug.AuthorizationCallback processes an OIDC authorization callback even when no Oidcc.Plug.Authorize session is present on the request. Instead of rejecting the request, it substitutes permissive placeholder values so the nonce, state, PKCE, peer IP, and user agent checks all pass with nothing to compare against, so a callback that carries a valid authorization code but no session is accepted. The fix rejects callbacks that lack an authorization session or a state parameter.
How do I fix this?
Upgrade the oidcc_plug library to the patch version.
Who does this affect?
You are affected if you run a version in the vulnerable range with Oidcc.Plug.AuthorizationCallback in its default configuration, your OIDC provider does not enforce PKCE.
Package
Versions
0.2.0 - 0.4.0
Fixed in 0.5.0Background info
oidcc_plug is vulnerable to Cross-Site Request Forgery (CSRF) in versions 0.2.0 - 0.4.0.
Links
GitHub Release
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.