The vulnerability in oidcc_plug arises from the AuthorizationCallback module's handling of callback requests that lack an Oidcc.Plug.Authorize session. Instead of rejecting such requests, the call/2 function applies permissive defaults, causing all downstream security checks to be skipped. An attacker can obtain an authorization code for their own account and induce a victim to visit the callback endpoint with that code but no state parameter. Because the application does not verify the state or other security parameters, it signs the victim into the attacker's account. This can lead to session confusion and potential account takeover, especially in applications that use the same callback for both sign-in and account linking. The vulnerability affects oidcc_plug versions from 0.2.0-beta.1 up to but not including 0.5.0. No official patch or remediation level is provided in the advisory.

An attacker can cause a victim's browser to complete an authorization flow the victim did not initiate, resulting in the victim being signed into the attacker's account. This can lead to session confusion where the victim's actions are performed under the attacker's identity. In scenarios where the callback endpoint is used for both sign-in and linking provider accounts, this vulnerability could enable account takeover by linking the attacker's account to the victim's. The overall impact is limited by the low CVSS score of 2.1, indicating low severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users of oidcc_plug should monitor the Erlang Ecosystem Foundation's advisories for updates. As a temporary measure, applications should ensure that callback requests without valid sessions or missing state parameters are rejected rather than processed with permissive defaults. Implementing strict validation of the state parameter and other security checks in the authorization callback flow can mitigate exploitation.