CVE-2026-66883

Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

View on CVE.org
Published Aug 4, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Description
Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.

This vulnerability is associated with program files lib/oidcc/plug/authorize.ex and lib/oidcc/plug/authorization_callback.ex, and program routines Oidcc.Plug.Authorize.call/2 and Oidcc.Plug.AuthorizationCallback.call/2.

Oidcc.Plug.Authorize.call/2 reads the initiating client's user agent with get_req_header(conn, "User-Agent"). Plug lowercases incoming header names, but get_req_header/2 matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and nil is written into the session. On the callback side, Oidcc.Plug.AuthorizationCallback treats a stored nil user agent as nothing to compare and returns :ok without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with check_useragent: true, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.

The impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled check_useragent are not affected in practice, since they never expected the binding. The corresponding lookup in Oidcc.Plug.AuthorizationCallback correctly uses the lowercase key and is not affected.

This issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0.

Analysis

AI-generated

Technical impact

In the Oidcc.Plug.Authorize module an improper case‑sensitive header lookup prevents the user agent string from being stored in the session. When the authorization callback later compares the stored value it finds nil and therefore accepts every request, allowing an attacker who has stolen a session cookie to replay it from a different user agent. The flaw does not provide direct code execution or credential theft, but it removes a safeguard that would normally detect replay attacks, weakening defense in depth.

Affected Systems

The vulnerability affects the Erlang Ecosystem Foundation’s oidcc_plug package. It is present in all releases from 0.1.0-alpha.3 up to, but not including, 0.5.0. The specific products are listed as oidcc_plug in the CNA data.

Risk and Exploitability

The CVSS score of 6.3 indicates a medium severity issue. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. The attack vector is likely a deployment that has enabled the check_useragent configuration flag; an attacker who can capture a valid session identifier can use it from another client without detection. The impact is confined to the loss of an additional replay protection layer, while CSRF, state, nonce, and PKCE checks remain functional.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade oidcc_plug to version 0.5.0 or later, which restores proper user‑agent header normalization.
  • If an upgrade is not immediately possible, add middleware or request handling logic that reads the stored user‑agent value and compares it to the incoming "User-Agent" header, rejecting mismatches.
  • Review session management configurations and monitor logs for anomalous replay activity, and consider disabling unnecessary session attributes that may be misconfigured.

Generated by OpenCVE AI on August 4, 2026 at 20:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Erlang Ecosystem Foundation
Erlang Ecosystem Foundation oidcc Plug
Vendors & Products Erlang Ecosystem Foundation
Erlang Ecosystem Foundation oidcc Plug
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files lib/oidcc/plug/authorize.ex and lib/oidcc/plug/authorization_callback.ex, and program routines Oidcc.Plug.Authorize.call/2 and Oidcc.Plug.AuthorizationCallback.call/2. Oidcc.Plug.Authorize.call/2 reads the initiating client's user agent with get_req_header(conn, "User-Agent"). Plug lowercases incoming header names, but get_req_header/2 matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and nil is written into the session. On the callback side, Oidcc.Plug.AuthorizationCallback treats a stored nil user agent as nothing to compare and returns :ok without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with check_useragent: true, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent. The impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled check_useragent are not affected in practice, since they never expected the binding. The corresponding lookup in Oidcc.Plug.AuthorizationCallback correctly uses the lowercase key and is not affected. This issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0.
Title Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup
First Time appeared Erlef
Erlef oidcc Plug
Weaknesses CWE-178
CPEs cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*
Vendors & Products Erlef
Erlef oidcc Plug
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-178

    Improper Handling of Case Sensitivity

Sources

Status
PUBLISHED
Assigner
EEF
Published
Updated
Aug 4, 2026, 12:27 PM
Reserved
Jul 28, 2026, 4:15 AM

View source JSON

Updated
Aug 4, 2026, 12:27 PM

JSON

Status
Awaiting Analysis
Published
Aug 4, 2026, 12:16 PM
Modified
Oct 23, 2026, 11:10 PM

View source JSON

No data.

Updated
Aug 5, 2026, 10:20 AM

JSON