CVE-2026-13089: CWE-347 Improper Verification of Cryptographic Signature in RITOU OIDC::Lite
OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self->alg($self->header->{alg}) from the token's own header and then calls decode_jwt(token, key, 1, [$self->alg]), handing JSON::WebToken an accepted-algorithm allowlist taken from the untrusted token. A token with alg=none yields ['none'], so decode_jwt returns the claims with no signature check, and a token with alg=HS256 is verified with the RP's RSA public key as the HMAC secret (RS to HS confusion). The ID Token is the OpenID Connect authentication assertion delivered to the Relying Party. Any caller that verifies an ID Token through the unpinned load(token)->verify path, or load(token, key) with only the key pinned, accepts a forged token carrying attacker-chosen claims such as sub and is authenticated as any user. Passing an explicit algorithm so $self->alg is already set bypasses the header-derived allowlist and is not affected. Note that the latest version uploaded to CPAN is 0.10. Later versions are available in the git repository.
AI Analysis
Technical Summary
CVE-2026-13089 describes an improper verification of cryptographic signatures in OIDC::Lite for Perl versions up to 0.12.1. The vulnerability arises because the verify method sets the algorithm from the token's own header when the caller does not pin an algorithm, passing this untrusted algorithm allowlist to the JSON::WebToken decoder. This allows an attacker to craft tokens with alg=none to bypass signature verification or use HS256 with the relying party's RSA public key as the HMAC secret, causing signature confusion. As a result, forged ID Tokens with attacker-chosen claims can be accepted, compromising authentication. Explicitly setting the algorithm in verification bypasses this issue. The latest CPAN version is 0.10, but newer versions exist in the git repository.
Potential Impact
An attacker can bypass ID Token signature verification, allowing them to impersonate any user by presenting a forged token with arbitrary claims. This compromises the authentication mechanism of OpenID Connect relying parties using vulnerable versions of OIDC::Lite without algorithm pinning. The integrity and trust of authentication assertions are broken, leading to potential unauthorized access.
Mitigation Recommendations
No official patch or fix is currently documented. Users should avoid verifying ID Tokens without explicitly pinning the algorithm parameter to prevent the vulnerability. Upgrading to versions beyond 0.12.1, if available from the git repository, may address the issue. Patch status is not yet confirmed — check the vendor advisory or repository for current remediation guidance.
CVE-2026-13089: CWE-347 Improper Verification of Cryptographic Signature in RITOU OIDC::Lite
Description
OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self->alg($self->header->{alg}) from the token's own header and then calls decode_jwt(token, key, 1, [$self->alg]), handing JSON::WebToken an accepted-algorithm allowlist taken from the untrusted token. A token with alg=none yields ['none'], so decode_jwt returns the claims with no signature check, and a token with alg=HS256 is verified with the RP's RSA public key as the HMAC secret (RS to HS confusion). The ID Token is the OpenID Connect authentication assertion delivered to the Relying Party. Any caller that verifies an ID Token through the unpinned load(token)->verify path, or load(token, key) with only the key pinned, accepts a forged token carrying attacker-chosen claims such as sub and is authenticated as any user. Passing an explicit algorithm so $self->alg is already set bypasses the header-derived allowlist and is not affected. Note that the latest version uploaded to CPAN is 0.10. Later versions are available in the git repository.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-13089 describes an improper verification of cryptographic signatures in OIDC::Lite for Perl versions up to 0.12.1. The vulnerability arises because the verify method sets the algorithm from the token's own header when the caller does not pin an algorithm, passing this untrusted algorithm allowlist to the JSON::WebToken decoder. This allows an attacker to craft tokens with alg=none to bypass signature verification or use HS256 with the relying party's RSA public key as the HMAC secret, causing signature confusion. As a result, forged ID Tokens with attacker-chosen claims can be accepted, compromising authentication. Explicitly setting the algorithm in verification bypasses this issue. The latest CPAN version is 0.10, but newer versions exist in the git repository.
Potential Impact
An attacker can bypass ID Token signature verification, allowing them to impersonate any user by presenting a forged token with arbitrary claims. This compromises the authentication mechanism of OpenID Connect relying parties using vulnerable versions of OIDC::Lite without algorithm pinning. The integrity and trust of authentication assertions are broken, leading to potential unauthorized access.
Mitigation Recommendations
No official patch or fix is currently documented. Users should avoid verifying ID Tokens without explicitly pinning the algorithm parameter to prevent the vulnerability. Upgrading to versions beyond 0.12.1, if available from the git repository, may address the issue. Patch status is not yet confirmed — check the vendor advisory or repository for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-06-23T18:53:35.254Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a61314c9c2644c7f8b00048
Added to database: 07/22/2026, 21:08:28 UTC
Last enriched: 07/30/2026, 01:07:31 UTC
Last updated: 09/03/2026, 22:52:09 UTC
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.