CVE-2026-13089: CWE-347 Improper Verification of Cryptographic Signature in RITOU OIDC::Lite
OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self->alg($self->header->{alg}) from the token's own header and then calls decode_jwt(token, key, 1, [$self->alg]), handing JSON::WebToken an accepted-algorithm allowlist taken from the untrusted token. A token with alg=none yields ['none'], so decode_jwt returns the claims with no signature check, and a token with alg=HS256 is verified with the RP's RSA public key as the HMAC secret (RS to HS confusion). The ID Token is the OpenID Connect authentication assertion delivered to the Relying Party. Any caller that verifies an ID Token through the unpinned load(token)->verify path, or load(token, key) with only the key pinned, accepts a forged token carrying attacker-chosen claims such as sub and is authenticated as any user. Passing an explicit algorithm so $self->alg is already set bypasses the header-derived allowlist and is not affected. Note that the latest version uploaded to CPAN is 0.10. Later versions are available in the git repository.
AI Analysis
Technical Summary
OIDC::Lite versions through 0.12.1 for Perl improperly verify cryptographic signatures on ID Tokens by accepting an algorithm allowlist derived from the token's own header when no algorithm is pinned by the caller. This allows an attacker to craft tokens with 'alg=none' to bypass signature checks or use 'alg=HS256' with the relying party's RSA public key as the HMAC secret, leading to signature verification bypass. The vulnerability arises from CWE-347 (Improper Verification of Cryptographic Signature) and affects the OpenID Connect authentication process, enabling attackers to forge tokens and impersonate users. Explicitly pinning the algorithm during verification mitigates the issue. The latest CPAN version is 0.10, with later versions available in the git repository, but no official patch or fix is documented.
Potential Impact
An attacker can bypass signature verification of OpenID Connect ID Tokens, allowing them to forge tokens with arbitrary claims such as user identity (sub). This compromises authentication, enabling impersonation of any user to the relying party. The vulnerability undermines the trust model of OpenID Connect authentication in affected versions of OIDC::Lite.
Mitigation Recommendations
No official patch or fix is currently documented. Users should avoid verifying ID Tokens without explicitly pinning the algorithm parameter to a trusted value rather than relying on the token's header. Passing an explicit algorithm to the verify method prevents the vulnerability. Check the vendor's git repository for newer versions that may address this issue. Monitor vendor advisories for official fixes.
CVE-2026-13089: CWE-347 Improper Verification of Cryptographic Signature in RITOU OIDC::Lite
Description
OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self->alg($self->header->{alg}) from the token's own header and then calls decode_jwt(token, key, 1, [$self->alg]), handing JSON::WebToken an accepted-algorithm allowlist taken from the untrusted token. A token with alg=none yields ['none'], so decode_jwt returns the claims with no signature check, and a token with alg=HS256 is verified with the RP's RSA public key as the HMAC secret (RS to HS confusion). The ID Token is the OpenID Connect authentication assertion delivered to the Relying Party. Any caller that verifies an ID Token through the unpinned load(token)->verify path, or load(token, key) with only the key pinned, accepts a forged token carrying attacker-chosen claims such as sub and is authenticated as any user. Passing an explicit algorithm so $self->alg is already set bypasses the header-derived allowlist and is not affected. Note that the latest version uploaded to CPAN is 0.10. Later versions are available in the git repository.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OIDC::Lite versions through 0.12.1 for Perl improperly verify cryptographic signatures on ID Tokens by accepting an algorithm allowlist derived from the token's own header when no algorithm is pinned by the caller. This allows an attacker to craft tokens with 'alg=none' to bypass signature checks or use 'alg=HS256' with the relying party's RSA public key as the HMAC secret, leading to signature verification bypass. The vulnerability arises from CWE-347 (Improper Verification of Cryptographic Signature) and affects the OpenID Connect authentication process, enabling attackers to forge tokens and impersonate users. Explicitly pinning the algorithm during verification mitigates the issue. The latest CPAN version is 0.10, with later versions available in the git repository, but no official patch or fix is documented.
Potential Impact
An attacker can bypass signature verification of OpenID Connect ID Tokens, allowing them to forge tokens with arbitrary claims such as user identity (sub). This compromises authentication, enabling impersonation of any user to the relying party. The vulnerability undermines the trust model of OpenID Connect authentication in affected versions of OIDC::Lite.
Mitigation Recommendations
No official patch or fix is currently documented. Users should avoid verifying ID Tokens without explicitly pinning the algorithm parameter to a trusted value rather than relying on the token's header. Passing an explicit algorithm to the verify method prevents the vulnerability. Check the vendor's git repository for newer versions that may address this issue. Monitor vendor advisories for official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-06-23T18:53:35.254Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a61314c9c2644c7f8b00048
Added to database: 07/22/2026, 21:08:28 UTC
Last enriched: 07/22/2026, 21:24:00 UTC
Last updated: 07/22/2026, 23:31:20 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.