The roadiz core-bundle-dev-app's openid package prior to versions 2.3.43, 2.5.45, 2.6.31, and 2.7.18 generates an OIDC nonce in OAuth2LinkGenerator::generate() and includes it in the authorization request. However, it fails to store and validate this nonce on the callback, as OpenIdJwtConfigurationFactory's validation chain lacks a nonce constraint and OpenIdAuthenticator::authenticate() does not verify the nonce claim in the returned ID token. This insufficient verification of data authenticity corresponds to CWE-345 and can undermine the security of the authentication process. The issue is patched in the versions mentioned.

The vulnerability allows an attacker to potentially bypass nonce verification in the OpenID Connect authentication flow, which could lead to replay attacks or acceptance of forged tokens. This undermines the integrity of the authentication process, potentially allowing unauthorized access. The CVSS 4.0 score is 5.7 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, but high impact on integrity.

A fix is available in roadiz core-bundle-dev-app versions 2.3.43, 2.5.45, 2.6.31, and 2.7.18. Users should upgrade to these or later versions to ensure nonce verification is properly implemented and the vulnerability is remediated. Patch status is confirmed by the vendor advisory indicating these versions contain the fix.