Junglewise Threat Intelligence

CVE-2026-13089: RITOU OIDC::Lite signature verification bypass in IDToken verify

CVE-2026-13089 · Severity: info · CVSS 0 · Published 2026-07-22

Executive brief

OIDC::Lite is a Perl library used by web applications to handle OpenID Connect authentication. A security flaw allows attackers to bypass identity verification by providing a specially crafted login token that tells the library to skip security checks. This could allow an attacker to impersonate any user and gain unauthorized access to sensitive accounts and data.

Technical details

OIDC::Lite versions through 0.12.1 are vulnerable to a signature verification bypass in OIDC::Lite::Model::IDToken::verify. When a caller does not explicitly pin a cryptographic algorithm, the library extracts the 'alg' header from the untrusted incoming JWT and uses it as the exclusive allowlist for verification. This enables two classic JWT attacks: the 'none' algorithm attack (where no signature is required) and 'RS256 to HS256' confusion (where a public key is treated as a symmetric HMAC secret). An attacker can exploit this by crafting a forged ID Token with arbitrary claims (such as 'sub') to impersonate any user. The vulnerability is mitigated if the developer manually pins the algorithm during the load() or verify() calls.

Affected products

  • RITOU OIDC::Lite through 0.12.1

Timeline

  • 2026-07-22: disclosed
  • 2026-07-22: advisory
  • 2026-07-22: patched: Patch available via GitHub PR #31 and MetaCPAN security patches.

References