The ueberauth_apple strategy in versions 0.1.0 up to but not including 0.6.2 verifies the JWT signature of Apple's ID token but fails to validate essential registered claims (iss, aud, exp, iat). The sub claim is used directly to identify the user without validation. An attacker who obtains a valid Apple-signed ID token with the victim's sub claim—such as a captured expired token or a token issued to another client in the same Apple developer team—can replay this token to authenticate as the victim. The lack of expiration (exp) claim validation allows indefinite reuse of stolen tokens, and the lack of audience (aud) claim validation enables cross-application account takeover among clients in the same Apple developer team.

Successful exploitation allows an attacker to bypass authentication and take over user accounts by replaying valid Apple-signed ID tokens without proper claim validation. This can lead to unauthorized access to victim accounts indefinitely, as expired tokens are not rejected, and cross-application account takeover is possible within the same Apple developer team.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users of ueberauth_apple should avoid relying on vulnerable versions (0.1.0 before 0.6.2) or implement additional validation of the iss, aud, and exp claims in the ID token before accepting authentication. Monitor vendor channels for updates and apply official patches once released.