In the Oidcc.Plug.Authorize module an improper case‑sensitive header lookup prevents the user agent string from being stored in the session. When the authorization callback later compares the stored value it finds nil and therefore accepts every request, allowing an attacker who has stolen a session cookie to replay it from a different user agent. The flaw does not provide direct code execution or credential theft, but it removes a safeguard that would normally detect replay attacks, weakening defense in depth.

The vulnerability affects the Erlang Ecosystem Foundation’s oidcc_plug package. It is present in all releases from 0.1.0-alpha.3 up to, but not including, 0.5.0. The specific products are listed as oidcc_plug in the CNA data.

The CVSS score of 6.3 indicates a medium severity issue. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. The attack vector is likely a deployment that has enabled the check_useragent configuration flag; an attacker who can capture a valid session identifier can use it from another client without detection. The impact is confined to the loss of an additional replay protection layer, while CSRF, state, nonce, and PKCE checks remain functional.