AIKIDO-2026-440418

TL;DR

OIDC request-object processing accepts a JWE-encrypted request object whose decrypted plaintext is unsigned raw JSON and honors those claims without enforcing the client's configured requestObjectSignatureAlg. An attacker can submit encrypted-but-unsigned claims and advance the authorization flow as if the request object were signed, violating OIDC Core and FAPI signing requirements. The redirect URI allowlist remains a compensating control. The fix rejects JWE request objects whose decrypted content is not a properly signed JWS when a signature algorithm is required.