AIKIDO-2026-373238

TL;DR

The plugin validates OIDC bearer tokens against any provider in its multi-provider registry but keys the resulting identity on the username claim alone, without binding it to the provider that asserted it. A valid token from one configured provider whose username claim matches an account owned by a different provider is authenticated as that account, allowing cross-provider account takeover. When bearer group claims are trusted, a secondary provider whose token asserts a group named like the admin group also provisions the principal as an administrator, because no policy limits which providers may confer administrator rights. The fix binds identities to the asserting provider and adds a per-provider admin_source policy so only trusted providers can grant admin.