CVE-2026-66883

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66883", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-07-28T04:15:10.240Z", "datePublished": "2026-08-04T11:46:05.191Z", "dateUpdated": "2026-08-04T12:27:58.024Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*"], "defaultStatus": "unaffected", "modules": ["Elixir.Oidcc.Plug.Authorize", "Elixir.Oidcc.Plug.AuthorizationCallback"], "packageName": "oidcc_plug", "packageURL": "pkg:hex/oidcc_plug", "product": "oidcc_plug", "programFiles": ["lib/oidcc/plug/authorize.ex", "lib/oidcc/plug/authorization_callback.ex"], "programRoutines": [{"name": "'Elixir.Oidcc.Plug.Authorize':call/2"}, {"name": "'Elixir.Oidcc.Plug.AuthorizationCallback':call/2"}], "repo": "https://github.com/erlef/oidcc_plug", "vendor": "Erlang Ecosystem Foundation", "versions": [{"lessThan": "0.5.0", "status": "affected", "version": "0.1.0-alpha.3", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*"], "defaultStatus": "unaffected", "modules": ["Elixir.Oidcc.Plug.Authorize", "Elixir.Oidcc.Plug.AuthorizationCallback"], "packageName": "erlef/oidcc_plug", "packageURL": "pkg:github/erlef/oidcc_plug", "product": "oidcc_plug", "programFiles": ["lib/oidcc/plug/authorize.ex", "lib/oidcc/plug/authorization_callback.ex"], "programRoutines": [{"name": "'Elixir.Oidcc.Plug.Authorize':call/2"}, {"name": "'Elixir.Oidcc.Plug.AuthorizationCallback':call/2"}], "repo": "https://github.com/erlef/oidcc_plug", "vendor": "Erlang Ecosystem Foundation", "versions": [{"lessThan": "f15e52c5750aaba701104b10ed96cfac063bd557", "status": "affected", "version": "0a75fb139d8e2686d1b75e0d48962323d2181673", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*", "versionEndExcluding": "0.5.0", "versionStartIncluding": "0.1.0-alpha.3", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Mathias Polligkeit"}, {"lang": "en", "type": "remediation developer", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation reviewer", "value": "Mathias Polligkeit"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (<code>Oidcc.Plug.Authorize</code> module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.</p>\n<p>This vulnerability is associated with program files <code>lib/oidcc/plug/authorize.ex</code> and <code>lib/oidcc/plug/authorization_callback.ex</code>, and program routines <code>Oidcc.Plug.Authorize.call/2</code> and <code>Oidcc.Plug.AuthorizationCallback.call/2</code>.</p>\n<p><code>Oidcc.Plug.Authorize.call/2</code> reads the initiating client's user agent with <code>get_req_header(conn, \"User-Agent\")</code>. Plug lowercases incoming header names, but <code>get_req_header/2</code> matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and <code>nil</code> is written into the session. On the callback side, <code>Oidcc.Plug.AuthorizationCallback</code> treats a stored <code>nil</code> user agent as nothing to compare and returns <code>:ok</code> without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with <code>check_useragent: true</code>, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.</p>\n<p>The impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled <code>check_useragent</code> are not affected in practice, since they never expected the binding. The corresponding lookup in <code>Oidcc.Plug.AuthorizationCallback</code> correctly uses the lowercase key and is not affected.</p>\n<p>This issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (`Oidcc.Plug.Authorize` module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.\n\nThis vulnerability is associated with program files `lib/oidcc/plug/authorize.ex` and `lib/oidcc/plug/authorization_callback.ex`, and program routines `Oidcc.Plug.Authorize.call/2` and `Oidcc.Plug.AuthorizationCallback.call/2`.\n\n`Oidcc.Plug.Authorize.call/2` reads the initiating client's user agent with `get_req_header(conn, \"User-Agent\")`. Plug lowercases incoming header names, but `get_req_header/2` matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and `nil` is written into the session. On the callback side, `Oidcc.Plug.AuthorizationCallback` treats a stored `nil` user agent as nothing to compare and returns `:ok` without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with `check_useragent: true`, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.\n\nThe impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled `check_useragent` are not affected in practice, since they never expected the binding. The corresponding lookup in `Oidcc.Plug.AuthorizationCallback` correctly uses the lowercase key and is not affected.\n\nThis issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0."}], "value": "Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.\n\nThis vulnerability is associated with program files lib/oidcc/plug/authorize.ex and lib/oidcc/plug/authorization_callback.ex, and program routines Oidcc.Plug.Authorize.call/2 and Oidcc.Plug.AuthorizationCallback.call/2.\n\nOidcc.Plug.Authorize.call/2 reads the initiating client's user agent with get_req_header(conn, \"User-Agent\"). Plug lowercases incoming header names, but get_req_header/2 matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and nil is written into the session. On the callback side, Oidcc.Plug.AuthorizationCallback treats a stored nil user agent as nothing to compare and returns :ok without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with check_useragent: true, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.\n\nThe impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled check_useragent are not affected in practice, since they never expected the binding. The corresponding lookup in Oidcc.Plug.AuthorizationCallback correctly uses the lowercase key and is not affected.\n\nThis issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0."}], "impacts": [{"capecId": "CAPEC-60", "descriptions": [{"lang": "en", "value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-04T11:46:05.191Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/erlef/oidcc_plug/security/advisories/GHSA-w5r8-m75h-98fc"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-66883.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66883"}, {"tags": ["patch"], "url": "https://github.com/erlef/oidcc_plug/commit/f15e52c5750aaba701104b10ed96cfac063bd557"}], "source": {"discovery": "EXTERNAL"}, "title": "Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup"}, "adp": [{"references": [{"url": "https://github.com/erlef/oidcc_plug/security/advisories/GHSA-w5r8-m75h-98fc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T12:27:16.535019Z", "id": "CVE-2026-66883", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T12:27:58.024Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66883", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-07-28T04:15:10.240Z", "datePublished": "2026-08-04T11:46:05.191Z", "dateUpdated": "2026-08-04T12:27:58.024Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*"], "defaultStatus": "unaffected", "modules": ["Elixir.Oidcc.Plug.Authorize", "Elixir.Oidcc.Plug.AuthorizationCallback"], "packageName": "oidcc_plug", "packageURL": "pkg:hex/oidcc_plug", "product": "oidcc_plug", "programFiles": ["lib/oidcc/plug/authorize.ex", "lib/oidcc/plug/authorization_callback.ex"], "programRoutines": [{"name": "'Elixir.Oidcc.Plug.Authorize':call/2"}, {"name": "'Elixir.Oidcc.Plug.AuthorizationCallback':call/2"}], "repo": "https://github.com/erlef/oidcc_plug", "vendor": "Erlang Ecosystem Foundation", "versions": [{"lessThan": "0.5.0", "status": "affected", "version": "0.1.0-alpha.3", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*"], "defaultStatus": "unaffected", "modules": ["Elixir.Oidcc.Plug.Authorize", "Elixir.Oidcc.Plug.AuthorizationCallback"], "packageName": "erlef/oidcc_plug", "packageURL": "pkg:github/erlef/oidcc_plug", "product": "oidcc_plug", "programFiles": ["lib/oidcc/plug/authorize.ex", "lib/oidcc/plug/authorization_callback.ex"], "programRoutines": [{"name": "'Elixir.Oidcc.Plug.Authorize':call/2"}, {"name": "'Elixir.Oidcc.Plug.AuthorizationCallback':call/2"}], "repo": "https://github.com/erlef/oidcc_plug", "vendor": "Erlang Ecosystem Foundation", "versions": [{"lessThan": "f15e52c5750aaba701104b10ed96cfac063bd557", "status": "affected", "version": "0a75fb139d8e2686d1b75e0d48962323d2181673", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*", "versionEndExcluding": "0.5.0", "versionStartIncluding": "0.1.0-alpha.3", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Mathias Polligkeit"}, {"lang": "en", "type": "remediation developer", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation reviewer", "value": "Mathias Polligkeit"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (<code>Oidcc.Plug.Authorize</code> module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.</p>\n<p>This vulnerability is associated with program files <code>lib/oidcc/plug/authorize.ex</code> and <code>lib/oidcc/plug/authorization_callback.ex</code>, and program routines <code>Oidcc.Plug.Authorize.call/2</code> and <code>Oidcc.Plug.AuthorizationCallback.call/2</code>.</p>\n<p><code>Oidcc.Plug.Authorize.call/2</code> reads the initiating client's user agent with <code>get_req_header(conn, \"User-Agent\")</code>. Plug lowercases incoming header names, but <code>get_req_header/2</code> matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and <code>nil</code> is written into the session. On the callback side, <code>Oidcc.Plug.AuthorizationCallback</code> treats a stored <code>nil</code> user agent as nothing to compare and returns <code>:ok</code> without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with <code>check_useragent: true</code>, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.</p>\n<p>The impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled <code>check_useragent</code> are not affected in practice, since they never expected the binding. The corresponding lookup in <code>Oidcc.Plug.AuthorizationCallback</code> correctly uses the lowercase key and is not affected.</p>\n<p>This issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (`Oidcc.Plug.Authorize` module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.\n\nThis vulnerability is associated with program files `lib/oidcc/plug/authorize.ex` and `lib/oidcc/plug/authorization_callback.ex`, and program routines `Oidcc.Plug.Authorize.call/2` and `Oidcc.Plug.AuthorizationCallback.call/2`.\n\n`Oidcc.Plug.Authorize.call/2` reads the initiating client's user agent with `get_req_header(conn, \"User-Agent\")`. Plug lowercases incoming header names, but `get_req_header/2` matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and `nil` is written into the session. On the callback side, `Oidcc.Plug.AuthorizationCallback` treats a stored `nil` user agent as nothing to compare and returns `:ok` without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with `check_useragent: true`, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.\n\nThe impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled `check_useragent` are not affected in practice, since they never expected the binding. The corresponding lookup in `Oidcc.Plug.AuthorizationCallback` correctly uses the lowercase key and is not affected.\n\nThis issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0."}], "value": "Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.\n\nThis vulnerability is associated with program files lib/oidcc/plug/authorize.ex and lib/oidcc/plug/authorization_callback.ex, and program routines Oidcc.Plug.Authorize.call/2 and Oidcc.Plug.AuthorizationCallback.call/2.\n\nOidcc.Plug.Authorize.call/2 reads the initiating client's user agent with get_req_header(conn, \"User-Agent\"). Plug lowercases incoming header names, but get_req_header/2 matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and nil is written into the session. On the callback side, Oidcc.Plug.AuthorizationCallback treats a stored nil user agent as nothing to compare and returns :ok without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with check_useragent: true, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.\n\nThe impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled check_useragent are not affected in practice, since they never expected the binding. The corresponding lookup in Oidcc.Plug.AuthorizationCallback correctly uses the lowercase key and is not affected.\n\nThis issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0."}], "impacts": [{"capecId": "CAPEC-60", "descriptions": [{"lang": "en", "value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-04T11:46:05.191Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/erlef/oidcc_plug/security/advisories/GHSA-w5r8-m75h-98fc"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-66883.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66883"}, {"tags": ["patch"], "url": "https://github.com/erlef/oidcc_plug/commit/f15e52c5750aaba701104b10ed96cfac063bd557"}], "source": {"discovery": "EXTERNAL"}, "title": "Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup"}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-66883", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T12:27:16.535019Z"}}}], "references": [{"url": "https://github.com/erlef/oidcc_plug/security/advisories/GHSA-w5r8-m75h-98fc", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T12:27:37.541Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*"], "defaultStatus": "unaffected", "modules": ["Elixir.Oidcc.Plug.Authorize", "Elixir.Oidcc.Plug.AuthorizationCallback"], "packageName": "oidcc_plug", "packageURL": "pkg:hex/oidcc_plug", "product": "oidcc_plug", "programFiles": ["lib/oidcc/plug/authorize.ex", "lib/oidcc/plug/authorization_callback.ex"], "programRoutines": [{"name": "'Elixir.Oidcc.Plug.Authorize':call/2"}, {"name": "'Elixir.Oidcc.Plug.AuthorizationCallback':call/2"}], "repo": "https://github.com/erlef/oidcc_plug", "vendor": "Erlang Ecosystem Foundation", "versions": [{"lessThan": "0.5.0", "status": "affected", "version": "0.1.0-alpha.3", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*"], "defaultStatus": "unaffected", "modules": ["Elixir.Oidcc.Plug.Authorize", "Elixir.Oidcc.Plug.AuthorizationCallback"], "packageName": "erlef/oidcc_plug", "packageURL": "pkg:github/erlef/oidcc_plug", "product": "oidcc_plug", "programFiles": ["lib/oidcc/plug/authorize.ex", "lib/oidcc/plug/authorization_callback.ex"], "programRoutines": [{"name": "'Elixir.Oidcc.Plug.Authorize':call/2"}, {"name": "'Elixir.Oidcc.Plug.AuthorizationCallback':call/2"}], "repo": "https://github.com/erlef/oidcc_plug", "vendor": "Erlang Ecosystem Foundation", "versions": [{"lessThan": "f15e52c5750aaba701104b10ed96cfac063bd557", "status": "affected", "version": "0a75fb139d8e2686d1b75e0d48962323d2181673", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.\n\nThis vulnerability is associated with program files lib/oidcc/plug/authorize.ex and lib/oidcc/plug/authorization_callback.ex, and program routines Oidcc.Plug.Authorize.call/2 and Oidcc.Plug.AuthorizationCallback.call/2.\n\nOidcc.Plug.Authorize.call/2 reads the initiating client's user agent with get_req_header(conn, \"User-Agent\"). Plug lowercases incoming header names, but get_req_header/2 matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and nil is written into the session. On the callback side, Oidcc.Plug.AuthorizationCallback treats a stored nil user agent as nothing to compare and returns :ok without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with check_useragent: true, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.\n\nThe impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled check_useragent are not affected in practice, since they never expected the binding. The corresponding lookup in Oidcc.Plug.AuthorizationCallback correctly uses the lowercase key and is not affected.\n\nThis issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0."}, {"lang": "es", "value": "La vulnerabilidad de manejo inadecuado de la distinci\u00f3n entre may\u00fasculas y min\u00fasculas en Erlang Ecosystem Foundation oidcc_plug (m\u00f3dulo Oidcc.Plug.Authorize) vuelve inerte la vinculaci\u00f3n de la sesi\u00f3n del agente de usuario, eliminando un control de defensa en profundidad contra la repetici\u00f3n de una sesi\u00f3n robada.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/oidcc/plug/authorize.ex y lib/oidcc/plug/authorization_callback.ex, y las rutinas de programa Oidcc.Plug.Authorize.call/2 y Oidcc.Plug.AuthorizationCallback.call/2.\n\nOidcc.Plug.Authorize.call/2 lee el agente de usuario del cliente iniciador con get_req_header(conn, \u2019User-Agent\u2019). Plug convierte a min\u00fasculas los nombres de encabezado entrantes, pero get_req_header/2 coincide exactamente con la clave proporcionada y no realiza ninguna normalizaci\u00f3n propia, por lo que la b\u00fasqueda con may\u00fasculas y min\u00fasculas siempre devuelve una lista vac\u00eda y nil se escribe en la sesi\u00f3n. En el lado de la devoluci\u00f3n de llamada, Oidcc.Plug.AuthorizationCallback trata un agente de usuario nil almacenado como nada que comparar y devuelve :ok sin inspeccionar la solicitud. Los dos comportamientos se combinan de modo que la verificaci\u00f3n pasa incondicionalmente en cada solicitud, incluso para implementaciones que optaron expl\u00edcitamente con check_useragent: true, y una devoluci\u00f3n de llamada de autorizaci\u00f3n puede completarse desde un agente de usuario diferente al que inici\u00f3 el flujo sin detecci\u00f3n. La verificaci\u00f3n falla abierta silenciosamente, sin error y sin entrada de registro, por lo que una implementaci\u00f3n no puede saber que la vinculaci\u00f3n est\u00e1 ausente.\n\nEl impacto se limita a la defensa en profundidad. La verificaci\u00f3n inerte no permite por s\u00ed misma a un atacante completar un flujo de autorizaci\u00f3n; elimina una capa que de otro modo dificultar\u00eda el uso de una sesi\u00f3n robada o filtrada, como una cookie de sesi\u00f3n exfiltrada repetida desde un cliente diferente. Las verificaciones de CSRF/estado, nonce y PKCE no se ven afectadas y contin\u00faan funcionando. Las implementaciones que nunca habilitaron check_useragent no se ven afectadas en la pr\u00e1ctica, ya que nunca esperaron la vinculaci\u00f3n. La b\u00fasqueda correspondiente en Oidcc.Plug.AuthorizationCallback utiliza correctamente la clave en min\u00fasculas y no se ve afectada.\n\nEste problema afecta a oidcc_plug: desde 0.1.0-alpha.3 antes de 0.5.0."}], "id": "CVE-2026-66883", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66883", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-04T12:27:16.535019Z", "version": "2.0.3"}}]}, "published": "2026-08-04T12:16:36.163", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-66883.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlef/oidcc_plug/commit/f15e52c5750aaba701104b10ed96cfac063bd557"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlef/oidcc_plug/security/advisories/GHSA-w5r8-m75h-98fc"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66883"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/erlef/oidcc_plug/security/advisories/GHSA-w5r8-m75h-98fc"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-178"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.1.0-alpha.3,0.5.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "oidcc_plug", "source": "cna", "vendor": "Erlang Ecosystem Foundation"}, "product": "oidcc_plug", "vendor": "erlang_ecosystem_foundation"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0a75fb139d8e2686d1b75e0d48962323d2181673,f15e52c5750aaba701104b10ed96cfac063bd557)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "oidcc_plug", "source": "cna", "vendor": "Erlang Ecosystem Foundation"}, "product": "oidcc_plug", "vendor": "erlang_ecosystem_foundation"}], "created": "2026-08-04T20:15:12.821203+00:00", "updated": "2026-08-05T10:20:11.667919+00:00", "vendors": ["erlang_ecosystem_foundation", "erlang_ecosystem_foundation$PRODUCT$oidcc_plug"]}