CVE-2026-75759: CWE-347 Improper Verification of Cryptographic Signature in erlef oidcc

The vulnerability in erlef oidcc stems from improper verification of cryptographic signatures (CWE-347). According to OpenID Connect Core 1.0, encrypted ID tokens must be signed before encryption, resulting in a Nested JWT. The oidcc implementation incorrectly accepts encrypted tokens without nested signatures as valid, allowing attackers who possess the relying party's public encryption key to mint tokens with arbitrary subject (sub), issuer (iss), and audience (aud) claims without the provider's signing key. This flaw is due to the verify_decrypted_token/4 function falling back to parsing plaintext claims without verifying a signature and the int_validate_jwt/4 function validating based on JOSE structure type rather than signature verification. The JARM validation path is also affected, reachable via the browser front channel. UserInfo responses are excluded from this issue as their encryption without signing is permitted by the specification. The affected versions are from 3.2.0-beta.1 up to but not including 3.9.0. No vendor advisory or patch information is currently available.

An unauthenticated attacker can impersonate arbitrary users by crafting encrypted ID tokens or JARM responses without valid signatures, potentially bypassing authentication controls. This undermines the trust model of OpenID Connect authentication flows relying on oidcc, leading to possible unauthorized access. The vulnerability does not affect UserInfo responses. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions of oidcc in security-critical environments or implement additional signature verification controls externally if possible.