CVE-2026-75759 | CVSS: N/A
Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signed then encrypted, with the result being a Nested JWT, and JARM processing rule 5 requires the client to check the signature unconditionally. oidcc instead accepted a JWE wrapping unsigned claims as fully validated, so anyone holding the relying party's public encryption key could mint a token with an a
参考链接:
• https://cna.erlef.org/cves/CVE-2026-75759.html
• https://github.com/erlef/oidcc/commit/5f62fbccdae8526ff62653b8901657a6c1400fd9
• https://github.com/erlef/oidcc/security/advisories/GHSA-533g-4vf3-xwrj
📌 数据来源: NVD 官方