CVE-2026-13089

Received Received - Intake

OIDC::Lite ID Token Signature Verification Bypass

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: CPANSec

Description

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self->alg($self->header->{alg}) from the token's own header and then calls decode_jwt(token, key, 1, [$self->alg]), handing JSON::WebToken an accepted-algorithm allowlist taken from the untrusted token. A token with alg=none yields ['none'], so decode_jwt returns the claims with no signature check, and a token with alg=HS256 is verified with the RP's RSA public key as the HMAC secret (RS to HS confusion). The ID Token is the OpenID Connect authentication assertion delivered to the Relying Party. Any caller that verifies an ID Token through the unpinned load(token)->verify path, or load(token, key) with only the key pinned, accepts a forged token carrying attacker-chosen claims such as sub and is authenticated as any user. Passing an explicit algorithm so $self->alg is already set bypasses the header-derived allowlist and is not affected. Note that the latest version uploaded to CPAN is 0.10. Later versions are available in the git repository.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-22

Generated

2026-07-23

AI Q&A

2026-07-23

EPSS Evaluated

N/A

NVD

CVE-2026-13089

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

OIDC::Lite versions through 0.12.1 for Perl allow attackers to bypass ID Token signature verification. The vulnerability occurs when the algorithm is not pinned, allowing the token's header to dictate the verification method. Attackers can forge tokens with arbitrary claims like 'sub' to impersonate any user.

Detection Guidance

To detect this vulnerability, check if your system uses OIDC::Lite versions through 0.12.1 for Perl. Inspect installed Perl modules with commands like 'cpan -D OIDC::Lite' or 'perl -MOIDC::Lite -e "print $OIDC::Lite::VERSION"'. If vulnerable versions are found, update to the latest patched version immediately.

Impact Analysis

If you use OIDC::Lite for authentication, attackers could impersonate legitimate users by forging ID tokens. This could lead to unauthorized access to sensitive data or actions within your system, depending on the permissions of the impersonated user.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Compliance may be compromised if user authentication is bypassed, potentially resulting in data breaches or unauthorized disclosures.

Mitigation Strategies

Update OIDC::Lite to the latest version from the git repository, as the latest CPAN version 0.10 is outdated. Ensure all ID Token verifications explicitly pass the algorithm parameter to avoid header-derived allowlist misuse. Review all authentication flows using OIDC::Lite for ID Token verification to confirm they pin the algorithm.

Hi! I’m here to help you understand CVE-2026-13089. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70