Skip to content
OpenAdvisories

Package · Hex

oidcc_plug

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.3
    CVE-2026-66883

    Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

    Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerabilit…

    Erlang Ecosystem Foundation oidcc_plug oidcc_plug Hex
  • Low 2.1
    CVE-2026-66884

    Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection

    Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.AuthorizationCallback module) allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associa…

    Erlang Ecosystem Foundation oidcc_plug oidcc_plug Hex