Skip to content
OpenAdvisories

Package · Hex

ueberauth_apple

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.1
    CVE-2026-55954

    Missing ID token claim validation in ueberauth_apple allows account takeover

    Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback id_token against Apple's JWK…

    ueberauth ueberauth_apple ueberauth_apple Hex