The roadiz core-bundle-dev-app's openid package generates an OIDC nonce during OAuth2 authorization requests but fails to store or validate this nonce upon receiving the ID token callback. The OpenIdJwtConfigurationFactory validation chain lacks a nonce constraint, and OpenIdAuthenticator::authenticate() does not verify the nonce claim against any stored value. This insufficient verification of data authenticity (CWE-345) could allow attackers to bypass certain security checks in the authentication process. The vulnerability affects multiple version branches prior to 2.3.43, 2.5.45, 2.6.31, and 2.7.18, where patches have been applied to enforce nonce validation.

An attacker could exploit this vulnerability to bypass nonce verification in the OpenID Connect authentication flow, potentially enabling replay attacks or token substitution. This undermines the integrity of the authentication process, possibly allowing unauthorized access or session hijacking. The CVSS 4.0 base score is 5.7 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, but high impact on integrity verification.

This vulnerability has been patched in roadiz versions 2.3.43, 2.5.45, 2.6.31, and 2.7.18. Users should upgrade to these or later versions to ensure nonce verification is properly enforced. No additional mitigation steps are indicated beyond applying the official patches.