Oidcc.Plug.AuthorizationCallback fails to enforce the CSRF checks that bind an authorization callback to a specific user session. When a callback request arrives without an Oidcc.Plug.Authorize session or without the state query parameter, the plug substitutes permissive defaults and all downstream checks—including nonce, state, PKCE, IP, and user‑agent verification—are bypassed. The result is that a victim’s browser can unknowingly complete an OpenID Connect authorization flow for an attacker’s account. The victim can be signed in as the attacker, allowing the attacker to read or act on the victim’s behalf, or to link the attacker’s account with the victim’s provider record, creating an account‑takeover scenario.

This vulnerability affects the Erlang Ecosystem Foundation’s oidcc_plug library in any release from version 0.2.0-beta.1 through 0.4.x before version 0.5.0. The issue resides in the Oidcc.Plug.AuthorizationCallback module’s call/2 function.

The CVSS score of 2.1 reflects the limited scope and the requirement for a social‑engineering element: the attacker must lure a user’s browser to visit the callback URL with a forged code and no state. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating no published exploits at this time. Although the vulnerability does allow an attacker to bypass authentication and potentially take over a victim’s account, the low CVSS score and absence of a known exploit reduce the immediate threat level. Still, because the flaw is a CSRF defect that could enable account takeover, administrators should treat it as a medium‑impact risk in environments where oidcc_plug is used for signin or account linking.