A critical authentication bypass vulnerability in RITOU OIDC::Lite allows attackers to forge ID tokens, leading to unauthorized user impersonation.

The vulnerability occurs when the caller does not pin a specific cryptographic algorithm. The library incorrectly sets the algorithm from the token header, allowing an unauthenticated attacker to bypass signature verification and forge arbitrary claims.

This vulnerability is critical as it directly undermines the authentication integrity of applications relying on OIDC::Lite. A CVSS score of 7.5 highlights the severity, as successful exploitation allows attackers to impersonate any user, bypass access controls, and gain unauthorized access to sensitive application data and functionality.

Immediate Action: Update RITOU OIDC::Lite to the latest version that includes the signature verification fix. If an update is not immediately available, ensure that all implementations explicitly pin the expected cryptographic algorithm to prevent the use of attacker-supplied values.

Proactive Monitoring: Monitor authentication logs for anomalies, such as tokens with unusual headers or suspicious claims that may indicate forgery attempts.

Compensating Controls: Implement strict identity provider validation and ensure that all token processing logic is performed within a secure, hardened environment that enforces cryptographic best practices.

Public Exploit Available: No (no confirmed public exploit available).

Given that this vulnerability targets the core security mechanism of authentication, it must be addressed immediately. Developers and security teams should prioritize upgrading the OIDC::Lite library and reviewing existing code to ensure that cryptographic algorithms are properly pinned.