The ueberauth_apple library's function Ueberauth.Strategy.Apple.Token.payload/2 verifies the JWT signature of the callback id_token against Apple's JWKS but fails to validate critical registered claims (iss, aud, exp, iat). The unvalidated sub claim is used directly to derive the authenticated user's identity. An attacker with any Apple-signed ID token containing the victim's sub claim—such as a captured expired token or a token issued to a sibling client in the same Apple developer team—can replay this token to bypass authentication and assume the victim's identity. The absence of expiration and audience claim checks enables indefinite token reuse and cross-application account takeover, respectively. This affects ueberauth_apple versions from 0.1.0 before 0.6.2.

Successful exploitation allows an attacker to bypass authentication and take over user accounts by replaying valid Apple-signed ID tokens without proper claim validation. This can lead to unauthorized access to user accounts across multiple applications within the same Apple developer team. The vulnerability is critical due to the high impact on confidentiality and integrity, with no user interaction required and low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using vulnerable versions of ueberauth_apple (versions 0.1.0 up to but not including 0.6.2). Implement additional validation of JWT registered claims (iss, aud, exp, iat) in the application logic to ensure tokens are valid and not expired. Monitor for updates from the ueberauth project regarding an official fix.