CVE-2026-66883— The Erlang Ecosystem Foundation Oidcc.Plug 输入验证错误漏洞
一分钟漏洞结论
影响对象
Erlang Ecosystem Foundation oidcc_plug
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
The Erlang Ecosystem Foundation Oidcc.Plug是The Erlang Ecosystem Foundation组织的一款身份认证插件。 The Erlang Ecosystem Foundation Oidcc.Plug 0.5.0之前版本存在输入验证错误漏洞，该漏洞源于大小写处理不当，导致Oidcc.Plug.Authorize模块在读取User-Agent请求头时未进行大小写归一化，将nil写入会话，使会话绑定检查失效，可能允许攻击者从不同用户代理完成授权回调而不
可能的 ATT&CK 技术 1 AI
T1528 · Steal Application Access Token影响版本矩阵 2
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Erlang Ecosystem Foundation | oidcc_plug | 0.1.0-alpha.3< 0.5.0 |
affected |
0a75fb139d8e2686d1b75e0d48962323d2181673< f15e52c5750aaba701104b10ed96cfac063bd557 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-66883 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup
来源: CVE Program / CVE List V5
Vulnerability Description
Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.
This vulnerability is associated with program files lib/oidcc/plug/authorize.ex and lib/oidcc/plug/authorization_callback.ex, and program routines Oidcc.Plug.Authorize.call/2 and Oidcc.Plug.AuthorizationCallback.call/2.
Oidcc.Plug.Authorize.call/2 reads the initiating client's user agent with get_req_header(conn, "User-Agent"). Plug lowercases incoming header names, but get_req_header/2 matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and nil is written into the session. On the callback side, Oidcc.Plug.AuthorizationCallback treats a stored nil user agent as nothing to compare and returns :ok without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with check_useragent: true, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.
The impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled check_useragent are not affected in practice, since they never expected the binding. The corresponding lookup in Oidcc.Plug.AuthorizationCallback correctly uses the lowercase key and is not affected.
This issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
来源: CVE Program / CVE List V5
Vulnerability Title
The Erlang Ecosystem Foundation Oidcc.Plug 输入验证错误漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
The Erlang Ecosystem Foundation Oidcc.Plug是The Erlang Ecosystem Foundation组织的一款身份认证插件。 The Erlang Ecosystem Foundation Oidcc.Plug 0.5.0之前版本存在输入验证错误漏洞，该漏洞源于大小写处理不当，导致Oidcc.Plug.Authorize模块在读取User-Agent请求头时未进行大小写归一化，将nil写入会话，使会话绑定检查失效，可能允许攻击者从不同用户代理完成授权回调而不
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Erlang Ecosystem Foundation | oidcc_plug | 0.1.0-alpha.3 ~ 0.5.0 |
cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*
|
|
| Erlang Ecosystem Foundation | oidcc_plug | 0a75fb139d8e2686d1b75e0d48962323d2181673 ~ f15e52c5750aaba701104b10ed96cfac063bd557 |
cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*
|
|
二、漏洞 CVE-2026-66883 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-66883 的情报信息
请登录查看更多情报信息。
CVE-2026-66883 补丁与修复 (1)
CVE-2026-66883 厂商安全公告 (2)
CVE-2026-66883 新闻报道 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-66883
暂无评论