CVE-2026-75759
Received Received - Intake

Improper Cryptographic Signature Verification in OIDCC

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signed then encrypted, with the result being a Nested JWT, and JARM processing rule 5 requires the client to check the signature unconditionally. oidcc instead accepted a JWE wrapping unsigned claims as fully validated, so anyone holding the relying party's public encryption key could mint a token with an arbitrary sub, iss, and aud without possessing the provider's signing key. In oidcc_jwt_util:verify_decrypted_token/4, a decrypted payload that is not a signed JWS fell back to parsing the plaintext claims and returning them with no verifying key. oidcc_token:int_validate_jwt/4 then matched on the JOSE structure type rather than on whether a signature had been verified, and returned success. The JARM path in oidcc_token:validate_jarm/3 is reachable through the browser front channel. UserInfo responses are not affected, because OpenID Connect Core 1.0 section 5.3.2 permits them to be encrypted without also being signed. This issue affects oidcc: from 3.2.0-beta.1 before 3.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-75759
EUVD
EUVD-2026-68145

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
erlef oidcc From 3.2.0-beta.1 (inc) to 3.9.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the erlef oidcc library allows an unauthenticated attacker to impersonate any user by exploiting improper cryptographic signature verification. The issue occurs when encrypted ID tokens or JARM responses are accepted without a nested signature, violating OpenID Connect Core 1.0 requirements. Attackers with the relying party's public encryption key can forge tokens with arbitrary subject, issuer, and audience values without possessing the provider's signing key.

Detection Guidance

To detect this vulnerability, check if your system uses oidcc versions between 3.2.0-beta.1 and 3.9.0. Inspect logs for improperly validated encrypted tokens or JARM responses. No specific commands are provided in the context, but monitor for tokens without nested signatures.

Impact Analysis

An attacker could impersonate users, gain unauthorized access to accounts, and perform actions on behalf of legitimate users. This could lead to data breaches, account takeovers, and potential manipulation of application data. The vulnerability is exploitable if the OpenID Provider advertises ID token encryption or JARM response encryption and the relying party has an encryption key configured.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in non-compliance with regulations mandating strict access controls and data integrity, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Immediately upgrade oidcc to version 3.9.0 or later. Ensure encrypted ID tokens and JARM responses include nested signatures. Disable encryption-only configurations if possible. Review and revoke any suspicious tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart