The vulnerability in oidcc_plug arises from the Oidcc.Plug.AuthorizationCallback.call/2 function, which processes callback requests lacking an Oidcc.Plug.Authorize session by substituting permissive defaults and skipping critical security checks. An attacker can obtain an authorization code for their own account and induce a victim to visit the callback endpoint with that code but without the required state parameter. Because the application does not reject such requests and disables security validations, the victim is signed into the attacker's account. This can lead to the victim's actions being performed under the attacker's identity and, in cases where the same callback is used for sign-in and account linking, may result in account takeover. Legitimate flows always include a state parameter, so the permissive fallback serves no conforming flow. The issue affects oidcc_plug versions from 0.2.0-beta.1 up to but not including 0.5.0.

The vulnerability allows an attacker to cause a victim's browser to complete an authorization flow the victim did not initiate, resulting in the victim being signed into the attacker's account. This can lead to unauthorized access to the victim's actions under the attacker's identity. Additionally, if the application uses the same callback for both signing in and linking provider accounts, the attacker can link their account to the victim's, potentially leading to account takeover. The CVSS 4.0 score is low (2.1), reflecting limited impact and the requirement for user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users of oidcc_plug should monitor the Erlang Ecosystem Foundation's advisories for updates. Until a fix is available, applications should ensure that callback requests without a valid session or missing state parameters are rejected and that all security checks (nonce, state, PKCE, peer IP, user agent) are enforced. Avoid reusing the same callback endpoint for both sign-in and account linking flows.