Erlang oidc_plug Session Binding Bypass via Header Case Sensitivity (CVE-2026-66883)

Vulnerability Overview Vulnerability ID: EEF-CVE-2026-66883 Source: CNA JSON Data: API Aliases: GHSA-w58r-m75h-98fc, CVE-2026-66883 Publication Date: 2026-08-04T11:46:05.191Z Modification Date: 2026-08-04T12:00:05.9175359Z Severity: 5.3 (Medium) CVSS Score: CVSS:4.0/AV:N/AC:L/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N Affected Scope Affected Module: Erlang Ecosystem Foundation (specifically the module) Specific Impact: Due to case-sensitive header lookups, user session binding becomes ineffective, thereby removing the defense against replayed stolen sessions. Vulnerability Details: - reads the user agent from the initiating client and retrieves the "User-Agent" header using . - The plugin converts incoming header names to lowercase, but performs an exact match on the provided header name without any normalization. - Consequently, mixed-case lookups always return an empty list and store that value in the session. - On the callback side, treats the stored user agent as empty content and returns without verifying the request. - The combination of these two behaviors causes the check to pass unconditionally, including returning for user agents with explicit opt-in checks and for requests initiated from different user agents that started the flow. - The check fails silently, with no errors and no log entries, meaning deployments cannot detect the missing binding. Impact Constraints: This vulnerability is limited to defense-in-depth. The ineffective check itself does not allow an attacker to complete the authorization flow; it removes another layer that could have obscured the user agent or stolen session. If a verified session cookie is replayed from a different client, CSRF/state/nonce and PKCE codes remain unaffected and continue to operate. Deployments where the check is disabled are unaffected because they never expected binding. The corresponding lookup in correctly uses lowercase keys and is not affected. Remediation Affected Versions: from 0.1.0-alpha.3 to 0.5.0 POC Code or Exploit Code No specific POC code or exploit code is provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Erlang oidc_plug Session Binding Bypass via Header Case Sensitivity (CVE-2026-66883)

More from this source