A critical cryptographic validation flaw in the Authlib library allows unauthenticated attackers to bypass integrity checks on OpenID Connect ID Tokens, potentially facilitating identity spoofing.

The vulnerability resides in the _verify_hash function of the Authlib library, which fails to correctly validate at_hash and c_hash claims. When provided with an unsupported cryptographic algorithm in the header, the library incorrectly defaults to a successful validation, allowing an unauthenticated attacker to bypass essential OIDC integrity protections.

The exploitation of this vulnerability compromises the security of authentication processes relying on OIDC, which may lead to unauthorized access to user accounts or sensitive services. With a CVSS score of 7.5, this high-severity flaw represents a significant risk to application integrity and user trust. Successful exploitation could result in identity theft, unauthorized data access, and a total breakdown of the established trust boundary between the identity provider and the service.

Immediate Action: Update the Authlib package to version 1.6.9 or later immediately to resolve the improper hash validation logic.

Proactive Monitoring: Monitor authentication logs for unusual OIDC ID token validation failures or requests containing malformed or unexpected algorithm headers.

Compensating Controls: Ensure that downstream services perform additional validation on OIDC claims and implement strict allow-lists for permitted cryptographic algorithms at the application level to mitigate the risk of bypass.

Public Exploit Available: Unknown.

Given the central role of Authlib in managing OAuth and OIDC workflows, this vulnerability poses a severe threat to any application utilizing the library for identity management. Security administrators must prioritize upgrading to version 1.6.9 across all production environments to eliminate the integrity bypass. Failure to patch allows for the potential compromise of user sessions and authentication bypasses that are difficult to detect via standard perimeter security tools.