Authentication Bypass in ueberauth_apple via Unvalidated JWT Claims

Executive Summary

CVE-2026-55954 is an Authentication Bypass by Spoofing vulnerability in the ueberauth_apple library, which is used for 'Sign in with Apple' authentication in Elixir applications.

The vulnerability occurs because the library verifies the JWT signature of the Apple ID token but fails to validate critical claims such as issuer (iss), audience (aud), expiration (exp), and issued-at time (iat).

The library directly uses the unvalidated 'sub' (subject) claim from the token to derive the logged-in user's UID and email. This allows an attacker to replay a captured or sibling client's token to gain unauthorized access to a victim's account.

• An attacker can obtain an Apple-signed ID token bearing the victim's 'sub' claim, either via a captured expired token or via a token issued to a sibling client in the same Apple developer team.
• The attacker can then replay this token against the vulnerable callback endpoint to authenticate as the victim.
• The absence of expiration (exp) checks means stolen tokens can be used indefinitely.
• The absence of audience (aud) checks enables cross-application account takeover across clients that share an Apple developer team.

This issue affects ueberauth_apple versions from 0.1.0 before 0.6.2.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your system is using a vulnerable version of the ueberauth_apple library (versions 0.1.0 to 0.6.1). You can inspect your Elixir application's dependencies to verify the installed version.

• Check the installed version of ueberauth_apple in your Elixir project by running: mix deps | grep ueberauth_apple. This will display the version currently in use.
• Review your application's authentication logs for unusual or repeated authentication attempts using Apple ID tokens. Look for tokens that may have been reused or tokens with mismatched claims.
• Monitor network traffic for replayed or suspicious Apple ID tokens during authentication flows. Tools like Wireshark or network logging can help identify repeated token submissions.

If you are unable to inspect the library version directly, you can also test for the vulnerability by attempting to replay an expired or sibling client's Apple ID token in a controlled environment. If the token is accepted without validation errors, the system is likely vulnerable.

Useful 0 Not Useful 0

Impact Analysis

If you are using a vulnerable version of the ueberauth_apple library (0.1.0 to 0.6.1) in your application, this vulnerability can have severe impacts.

• Account Takeover: An attacker can gain unauthorized access to any user's account that uses 'Sign in with Apple' for authentication.
• Data Breach: Once authenticated as a victim, the attacker can access sensitive user data stored in your application, such as personal information, messages, or financial details.
• Unauthorized Actions: The attacker can perform actions on behalf of the victim, such as changing account settings, making purchases, or posting content.
• Cross-Application Attacks: If your application shares an Apple developer team with other applications, an attacker can use a token from one application to gain access to accounts in another application.
• Long-Term Exploitation: Since there is no expiration check, stolen tokens can be reused indefinitely, increasing the risk of prolonged unauthorized access.

This can lead to loss of user trust, reputational damage, and potential legal consequences for your organization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can significantly impact compliance with common data protection and privacy regulations.

• GDPR (General Data Protection Regulation): Under GDPR, organizations must implement appropriate technical measures to protect personal data. A vulnerability that allows unauthorized access to user accounts constitutes a failure to protect personal data, potentially leading to fines of up to 4% of global annual revenue or €20 million, whichever is higher. Additionally, organizations must report data breaches to authorities within 72 hours, which could result in reputational damage and further regulatory scrutiny.
• HIPAA (Health Insurance Portability and Accountability Act): If your application handles protected health information (PHI), this vulnerability could lead to unauthorized access to sensitive health data. HIPAA requires strict access controls and safeguards to protect PHI. A breach could result in significant fines, legal action, and mandatory corrective action plans.
• Other Regulations: Similar impacts apply to other regulations like CCPA (California Consumer Privacy Act), which grants users rights over their personal data and imposes penalties for data breaches. Non-compliance can lead to legal action, fines, and loss of business licenses.

Beyond financial penalties, non-compliance can damage your organization's reputation, erode customer trust, and lead to loss of business opportunities.

Useful 0 Not Useful 0

Mitigation Strategies

The most effective mitigation is to update the ueberauth_apple library to version 0.6.2 or later, which includes fixes for the missing claim validations.

• Update the ueberauth_apple dependency in your mix.exs file to at least version 0.6.2: {:ueberauth_apple, ">= 0.6.2"}. Then run mix deps.update ueberauth_apple to apply the update.
• If immediate updating is not possible, implement temporary compensating controls such as rate-limiting authentication attempts or monitoring for suspicious token usage.
• Review and validate all Apple ID tokens manually in your application code until the library update is applied. Ensure that the iss, aud, exp, and iat claims are checked before processing the token.
• Rotate any sensitive credentials or secrets associated with your Apple developer account to prevent potential misuse of compromised tokens.

After applying the update, test your authentication flow thoroughly to ensure that tokens with invalid claims are rejected and that legitimate users can still authenticate successfully.

Useful 0 Not Useful 0