Executive brief
Roadiz is a content management system used to build and manage websites. A security flaw in its login system allows attackers to potentially reuse intercepted login credentials (ID tokens) to gain unauthorized access to user accounts. This occurs because the system fails to verify a unique security code (nonce) during the login process, which is a standard requirement for secure authentication.
Technical details
The roadiz/openid package generates an OIDC nonce in OAuth2LinkGenerator::generate() and includes it in the authorization request, but fails to store or validate it upon callback. The OpenIdJwtConfigurationFactory validation chain lacks a nonce constraint, and OpenIdAuthenticator::authenticate() does not verify the nonce claim in the returned ID token against a stored value. This violation of the OIDC Core 1.0 specification allows an attacker to perform ID token replay attacks or token injection attacks if they can intercept a valid token. The issue is patched in versions 2.3.43, 2.5.45, 2.6.31, and 2.7.18.
Affected products
- Roadiz roadiz/openid < 2.3.43, < 2.5.45, < 2.6.31, < 2.7.18
Timeline
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD