A critical cryptographic verification flaw in the erlef oidcc library enables unauthenticated attackers to perform full identity impersonation, posing a severe risk to authentication integrity.

This vulnerability occurs because the library fails to enforce mandatory signature checks for encrypted ID tokens and JARM responses. An unauthenticated attacker can bypass validation logic in the oidcc_jwt_util and oidcc_token modules to craft tokens that the application erroneously accepts as fully validated.

Successful exploitation allows an attacker to impersonate any user, including administrative accounts, by minting arbitrary tokens. Given the High CVSS score of 7.6, the potential for unauthorized access to sensitive user data and account takeover is significant, which could lead to severe reputational damage and widespread unauthorized system activity.

Immediate Action: Update the erlef oidcc library to version 3.9.0 or later immediately to incorporate the necessary cryptographic validation logic.

Proactive Monitoring: Review authentication and access logs for suspicious token issuance patterns or unexpected identity claims that do not correlate with known user sessions.

Compensating Controls: Ensure that all OIDC flows utilize strict transport security and consider implementing additional secondary validation checks on identity claims at the application gateway level if immediate patching is delayed.

Public Exploit Available: Unknown

This vulnerability represents a critical failure in the identity verification chain of the oidcc library. Organizations relying on this library for OpenID Connect integration must prioritize updating to version 3.9.0 as soon as possible to prevent potential unauthorized access. Failure to address this flaw leaves authentication mechanisms completely open to impersonation attacks.