Roadiz OIDC nonce not verified leading to ID token replay (CVE-2026-4206)

Vulnerability Overview Title: OpenID Connect nonce generated but not verified — ID token replay attack Description: The package generates an OIDC nonce in and includes it in the authorization request sent to the identity provider. However, this nonce is neither stored in a session, cache, or any other persistent storage, nor is it verified during the callback. The validation chain in does not include a nonce constraint, and never checks whether the claim in the returned ID token matches a stored value. Scope Affected Versions: - - - - Severity: Medium CVE ID: CVE-2026-4206 Weakness: CWE-345 Remediation Fixed Versions: - - - - Detailed Information Nonce Generation: This value is not stored in a session, cache, or any other persistent storage. JWT Validation Constraints: - (expiry) - (audience) - (issuer) - (optional) - (optional) Missing Nonce Constraint: In , the method correctly validates the CSRF state token (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the claim in the ID token. Proof of Concept (PoC) 1. Obtain the target user's ID token from a legitimate OIDC flow (e.g., via network interception, browser history leakage, or exposure through referrer headers in non-HTTPS redirects). 2. Replay the ID token: Since the nonce in the token is not cross-checked against a client-side stored value, all validation constraints will pass as long as the token has not expired. 3. Result: An attacker can authenticate as the victim for the duration of the ID token's validity. Additionally, in the authorization code flow, if multiple concurrent sessions exist, a malicious or compromised identity provider or token endpoint can inject a token with a mismatched nonce, which the application will silently accept. Impact ID Token Replay Attack: Valid but intercepted tokens can be reused for authentication within their validity period. Token Injection Attack: Malicious or compromised identity providers can inject tokens across sessions without detection. This affects all Roadiz applications using the package and authenticating via OpenID Connect SSO. The OpenID Connect Core 1.0 specification (Section 3.1.3.7) explicitly mandates that clients must verify the claim in ID tokens.

Goal Reached Thanks to every supporter — we hit 100%!

Roadiz OIDC nonce not verified leading to ID token replay (CVE-2026-4206)

More from this source