Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-66884— Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection

Quick assessment

Affected
Erlang Ecosystem Foundation oidcc_plug
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

The Erlang Ecosystem Foundation oidcc是The Erlang Ecosystem Foundation基金会开源的一个Erlang&Elixir中的OpenId Connect客户端库。 The Erlang Ecosystem Foundation oidcc 0.2.0-beta.1版本至0.5.0之前版本存在跨站请求伪造漏洞，该漏洞源于回调请求处理时未正确验证会话，导致nonce、state、PKCE、peer IP和user agent检查被跳过，可能允许攻击者

CVSS 2.1 · Low EPSS 0.26% · P17

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
Erlang Ecosystem Foundation oidcc_plug 0.2.0-beta.1< 0.5.0 affected
e577ae73b9080693442916043a22d8f05491dd93< 97d75afc57826dca31989b47d6e2a3c136039917 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-66884

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.AuthorizationCallback module) allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file lib/oidcc/plug/authorization_callback.ex and program routine Oidcc.Plug.AuthorizationCallback.call/2. A callback request that carries no Oidcc.Plug.Authorize session is processed with every security check disabled rather than being rejected. call/2 substitutes permissive defaults for the absent session, and each downstream check treats its value as nothing to compare and returns :ok, so the nonce, state, PKCE, peer IP and user agent checks are all skipped. A separate clause of check_state/2 also accepts a state-less request when a verifier is present. An attacker obtains an authorization code for their own provider account, then induces the victim to visit the callback endpoint with that code and no state parameter. The application signs the victim in as the attacker, so the victim's subsequent actions occur in the attacker's account where the attacker can read them. Applications reusing one callback for both signing in and linking a provider account are further exposed to account takeover, the attacker's account becoming linked to the victim's. The permissive fallback serves no conforming flow. Third-party-initiated login reaches a relying party at a separate login initiation endpoint and causes it to send a fresh authentication request, and this library implements no such endpoint. Oidcc.Plug.Authorize always sends a state parameter, which an authorization server must echo, so no legitimate callback lacks one. This issue affects oidcc_plug: from 0.2.0-beta.1 before 0.5.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
The Erlang Ecosystem Foundation oidcc 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
The Erlang Ecosystem Foundation oidcc是The Erlang Ecosystem Foundation基金会开源的一个Erlang&Elixir中的OpenId Connect客户端库。 The Erlang Ecosystem Foundation oidcc 0.2.0-beta.1版本至0.5.0之前版本存在跨站请求伪造漏洞，该漏洞源于回调请求处理时未正确验证会话，导致nonce、state、PKCE、peer IP和user agent检查被跳过，可能允许攻击者
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Erlang Ecosystem Foundation oidcc_plug 0.2.0-beta.1 ~ 0.5.0 cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*
Erlang Ecosystem Foundation oidcc_plug e577ae73b9080693442916043a22d8f05491dd93 ~ 97d75afc57826dca31989b47d6e2a3c136039917 cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*

II. Public POCs for CVE-2026-66884

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-66884

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-66884 (1)

Vendor Advisories for CVE-2026-66884 (2)

Other References for CVE-2026-66884 (1)

IV. Related Vulnerabilities

Same product: oidcc_plug
Same vendor: Erlang Ecosystem Foundation
Same weakness: CWE-352