Skip to content
OpenAdvisories

Package · Hex

oidcc

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.6
    CVE-2026-75759

    Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

    Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requir…

    erlef oidcc oidcc Hex
  • Medium 5.3
    CVE-2024-31209

    OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

    oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has bee…

    erlef oidcc oidcc Hex