Executive brief
OIDC::Lite is a Perl library used by web applications to handle OpenID Connect authentication. A security flaw allows attackers to bypass identity verification by providing a specially crafted login token that tells the library to skip security checks. This could allow an attacker to impersonate any user and gain unauthorized access to sensitive accounts and data.
Technical details
OIDC::Lite versions through 0.12.1 are vulnerable to a signature verification bypass in OIDC::Lite::Model::IDToken::verify. When a caller does not explicitly pin a cryptographic algorithm, the library extracts the 'alg' header from the untrusted incoming JWT and uses it as the exclusive allowlist for verification. This enables two classic JWT attacks: the 'none' algorithm attack (where no signature is required) and 'RS256 to HS256' confusion (where a public key is treated as a symmetric HMAC secret). An attacker can exploit this by crafting a forged ID Token with arbitrary claims (such as 'sub') to impersonate any user. The vulnerability is mitigated if the developer manually pins the algorithm during the load() or verify() calls.
Affected products
- RITOU OIDC::Lite through 0.12.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Patch available via GitHub PR #31 and MetaCPAN security patches.