Roadiz CMS without patch in its openid package creates an OIDC nonce during the authorization request but never stores or revisits it upon callback. Because the nonce is not validated against a stored value, an attacker can capture and replay a legitimate ID token, allowing impersonation of an authenticated user without having to forge credentials. The vulnerability, classified as CWE-345, permits an ID token replay attack that can compromise authentication integrity.

The flaw exists in the Roadiz core-bundle-dev-app for all releases prior to 2.3.43, 2.5.45, 2.6.31, and 2.7.18. Any instance of Roadiz using those older versions is vulnerable, particularly where the openid integration is active.

With a CVSS score of 5.7, the vulnerability carries a moderate severity rating and poses a tangible risk in environments lacking additional nonce checks. Since no EPSS value is available and the issue is not listed in CISA KEV, there is no documented active exploitation, yet the attack vector likely involves a remote attacker replaying an ID token captured during a legitimate authentication flow. The absence of nonce validation directly undermines authentication correctness and can lead to unauthorized access.