{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66883", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-07-28T04:15:10.240Z", "datePublished": "2026-08-04T11:46:05.191Z", "dateUpdated": "2026-08-04T12:27:58.024Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*"], "defaultStatus": "unaffected", "modules": ["Elixir.Oidcc.Plug.Authorize", "Elixir.Oidcc.Plug.AuthorizationCallback"], "packageName": "oidcc_plug", "packageURL": "pkg:hex/oidcc_plug", "product": "oidcc_plug", "programFiles": ["lib/oidcc/plug/authorize.ex", "lib/oidcc/plug/authorization_callback.ex"], "programRoutines": [{"name": "'Elixir.Oidcc.Plug.Authorize':call/2"}, {"name": "'Elixir.Oidcc.Plug.AuthorizationCallback':call/2"}], "repo": "https://github.com/erlef/oidcc_plug", "vendor": "Erlang Ecosystem Foundation", "versions": [{"lessThan": "0.5.0", "status": "affected", "version": "0.1.0-alpha.3", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*"], "defaultStatus": "unaffected", "modules": ["Elixir.Oidcc.Plug.Authorize", "Elixir.Oidcc.Plug.AuthorizationCallback"], "packageName": "erlef/oidcc_plug", "packageURL": "pkg:github/erlef/oidcc_plug", "product": "oidcc_plug", "programFiles": ["lib/oidcc/plug/authorize.ex", "lib/oidcc/plug/authorization_callback.ex"], "programRoutines": [{"name": "'Elixir.Oidcc.Plug.Authorize':call/2"}, {"name": "'Elixir.Oidcc.Plug.AuthorizationCallback':call/2"}], "repo": "https://github.com/erlef/oidcc_plug", "vendor": "Erlang Ecosystem Foundation", "versions": [{"lessThan": "f15e52c5750aaba701104b10ed96cfac063bd557", "status": "affected", "version": "0a75fb139d8e2686d1b75e0d48962323d2181673", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*", "versionEndExcluding": "0.5.0", "versionStartIncluding": "0.1.0-alpha.3", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Mathias Polligkeit"}, {"lang": "en", "type": "remediation developer", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation reviewer", "value": "Mathias Polligkeit"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (<code>Oidcc.Plug.Authorize</code> module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.</p>\n<p>This vulnerability is associated with program files <code>lib/oidcc/plug/authorize.ex</code> and <code>lib/oidcc/plug/authorization_callback.ex</code>, and program routines <code>Oidcc.Plug.Authorize.call/2</code> and <code>Oidcc.Plug.AuthorizationCallback.call/2</code>.</p>\n<p><code>Oidcc.Plug.Authorize.call/2</code> reads the initiating client's user agent with <code>get_req_header(conn, \"User-Agent\")</code>. Plug lowercases incoming header names, but <code>get_req_header/2</code> matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and <code>nil</code> is written into the session. On the callback side, <code>Oidcc.Plug.AuthorizationCallback</code> treats a stored <code>nil</code> user agent as nothing to compare and returns <code>:ok</code> without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with <code>check_useragent: true</code>, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.</p>\n<p>The impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled <code>check_useragent</code> are not affected in practice, since they never expected the binding. The corresponding lookup in <code>Oidcc.Plug.AuthorizationCallback</code> correctly uses the lowercase key and is not affected.</p>\n<p>This issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (`Oidcc.Plug.Authorize` module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.\n\nThis vulnerability is associated with program files `lib/oidcc/plug/authorize.ex` and `lib/oidcc/plug/authorization_callback.ex`, and program routines `Oidcc.Plug.Authorize.call/2` and `Oidcc.Plug.AuthorizationCallback.call/2`.\n\n`Oidcc.Plug.Authorize.call/2` reads the initiating client's user agent with `get_req_header(conn, \"User-Agent\")`. Plug lowercases incoming header names, but `get_req_header/2` matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and `nil` is written into the session. On the callback side, `Oidcc.Plug.AuthorizationCallback` treats a stored `nil` user agent as nothing to compare and returns `:ok` without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with `check_useragent: true`, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.\n\nThe impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled `check_useragent` are not affected in practice, since they never expected the binding. The corresponding lookup in `Oidcc.Plug.AuthorizationCallback` correctly uses the lowercase key and is not affected.\n\nThis issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0."}], "value": "Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.\n\nThis vulnerability is associated with program files lib/oidcc/plug/authorize.ex and lib/oidcc/plug/authorization_callback.ex, and program routines Oidcc.Plug.Authorize.call/2 and Oidcc.Plug.AuthorizationCallback.call/2.\n\nOidcc.Plug.Authorize.call/2 reads the initiating client's user agent with get_req_header(conn, \"User-Agent\"). Plug lowercases incoming header names, but get_req_header/2 matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and nil is written into the session. On the callback side, Oidcc.Plug.AuthorizationCallback treats a stored nil user agent as nothing to compare and returns :ok without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with check_useragent: true, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.\n\nThe impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled check_useragent are not affected in practice, since they never expected the binding. The corresponding lookup in Oidcc.Plug.AuthorizationCallback correctly uses the lowercase key and is not affected.\n\nThis issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0."}], "impacts": [{"capecId": "CAPEC-60", "descriptions": [{"lang": "en", "value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-04T11:46:05.191Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/erlef/oidcc_plug/security/advisories/GHSA-w5r8-m75h-98fc"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-66883.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66883"}, {"tags": ["patch"], "url": "https://github.com/erlef/oidcc_plug/commit/f15e52c5750aaba701104b10ed96cfac063bd557"}], "source": {"discovery": "EXTERNAL"}, "title": "Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup"}, "adp": [{"references": [{"url": "https://github.com/erlef/oidcc_plug/security/advisories/GHSA-w5r8-m75h-98fc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T12:27:16.535019Z", "id": "CVE-2026-66883", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T12:27:58.024Z"}}]}}

{}

{}

{}

{}