OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify
Summary
| CVE | CVE-2026-13089 |
|---|---|
| State | PUBLISHED |
| Assigner | CPANSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-22 21:17:12 UTC |
| Updated | 2026-07-22 23:16:33 UTC |
| Description | OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self->alg($self->header->{alg}) from the token's own header and then calls decode_jwt(token, key, 1, [$self->alg]), handing JSON::WebToken an accepted-algorithm allowlist taken from the untrusted token. A token with alg=none yields ['none'], so decode_jwt returns the claims with no signature check, and a token with alg=HS256 is verified with the RP's RSA public key as the HMAC secret (RS to HS confusion). The ID Token is the OpenID Connect authentication assertion delivered to the Relying Party. Any caller that verifies an ID Token through the unpinned load(token)->verify path, or load(token, key) with only the key pinned, accepts a forged token carrying attacker-chosen claims such as sub and is authenticated as any user. Passing an explicit algorithm so $self->alg is already set bypasses the header-derived allowlist and is not affected. Note that the latest version uploaded to CPAN is 0.10. Later versions are available in the git repository. |
Risk And Classification
Problem Types: CWE-347 | CWE-347 CWE-347 Improper Verification of Cryptographic Signature
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.openwall.com/lists/oss-security/2026/07/22/17 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| datatracker.ietf.org/doc/html/rfc8725 | 9b29abf9-4ab0-4765-b253-1875cd9b441e | datatracker.ietf.org | |
| security.metacpan.org/patches/O/OIDC-Lite/0.10/CVE-2026-13089-r1.patch | 9b29abf9-4ab0-4765-b253-1875cd9b441e | security.metacpan.org | |
| github.com/ritou/p5-oidc-lite/pull/31 | 9b29abf9-4ab0-4765-b253-1875cd9b441e | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Workarounds
CNA: Apply the patch. Otherwise, pin the expected signature algorithm at the call site, for example OIDC::Lite::Model::IDToken->load($token, $key, $alg) with an explicit non-none $alg, so verify uses the pinned algorithm instead of the value in the token header.
There are currently no legacy QID mappings associated with this CVE.