CVE-2026-66883
Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup
Description
Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files lib/oidcc/plug/authorize.ex and lib/oidcc/plug/authorization_callback.ex, and program routines Oidcc.Plug.Authorize.call/2 and Oidcc.Plug.AuthorizationCallback.call/2. Oidcc.Plug.Authorize.call/2 reads the initiating client's user agent with get_req_header(conn, "User-Agent"). Plug lowercases incoming header names, but get_req_header/2 matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and nil is written into the session. On the callback side, Oidcc.Plug.AuthorizationCallback treats a stored nil user agent as nothing to compare and returns :ok without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with check_useragent: true, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent. The impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled check_useragent are not affected in practice, since they never expected the binding. The corresponding lookup in Oidcc.Plug.AuthorizationCallback correctly uses the lowercase key and is not affected. This issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0.
INFO
Published Date :
Aug. 4, 2026, 12:16 p.m.
Last Modified :
Oct. 23, 2026, 11:10 p.m.
Remotely Exploit :
Yes !
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update oidcc_plug to version 0.5.0 or later.
- Verify user agent checking is enabled and functioning.
- Implement additional session binding checks.
- Monitor logs for authentication anomalies.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-66883.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-66883 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-66883
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-66883 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-66883 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: oidcc_plug de Erlang Ecosystem Foundation, Description: La vulnerabilidad de manejo inadecuado de la distinción entre mayúsculas y minúsculas en Erlang Ecosystem Foundation oidcc_plug (módulo Oidcc.Plug.Authorize) vuelve inerte la vinculación de la sesión del agente de usuario, eliminando un control de defensa en profundidad contra la repetición de una sesión robada. Esta vulnerabilidad está asociada con los archivos de programa lib/oidcc/plug/authorize.ex y lib/oidcc/plug/authorization_callback.ex, y las rutinas de programa Oidcc.Plug.Authorize.call/2 y Oidcc.Plug.AuthorizationCallback.call/2. Oidcc.Plug.Authorize.call/2 lee el agente de usuario del cliente iniciador con get_req_header(conn, ’User-Agent’). Plug convierte a minúsculas los nombres de encabezado entrantes, pero get_req_header/2 coincide exactamente con la clave proporcionada y no realiza ninguna normalización propia, por lo que la búsqueda con mayúsculas y minúsculas siempre devuelve una lista vacía y nil se escribe en la sesión. En el lado de la devolución de llamada, Oidcc.Plug.AuthorizationCallback trata un agente de usuario nil almacenado como nada que comparar y devuelve :ok sin inspeccionar la solicitud. Los dos comportamientos se combinan de modo que la verificación pasa incondicionalmente en cada solicitud, incluso para implementaciones que optaron explícitamente con check_useragent: true, y una devolución de llamada de autorización puede completarse desde un agente de usuario diferente al que inició el flujo sin detección. La verificación falla abierta silenciosamente, sin error y sin entrada de registro, por lo que una implementación no puede saber que la vinculación está ausente. El impacto se limita a la defensa en profundidad. La verificación inerte no permite por sí misma a un atacante completar un flujo de autorización; elimina una capa que de otro modo dificultaría el uso de una sesión robada o filtrada, como una cookie de sesión exfiltrada repetida desde un cliente diferente. Las verificaciones de CSRF/estado, nonce y PKCE no se ven afectadas y continúan funcionando. Las implementaciones que nunca habilitaron check_useragent no se ven afectadas en la práctica, ya que nunca esperaron la vinculación. La búsqueda correspondiente en Oidcc.Plug.AuthorizationCallback utiliza correctamente la clave en minúsculas y no se ve afectada. Este problema afecta a oidcc_plug: desde 0.1.0-alpha.3 antes de 0.5.0. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 04, 2026
Action Type Old Value New Value Added Reference https://github.com/erlef/oidcc_plug/security/advisories/GHSA-w5r8-m75h-98fc Added SSVC {'id': 'CVE-2026-66883', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-04T12:27:16.535019Z'} -
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Aug. 04, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*'], 'repo': 'https://github.com/erlef/oidcc_plug', 'vendor': 'Erlang Ecosystem Foundation', 'modules': ['Elixir.Oidcc.Plug.Authorize', 'Elixir.Oidcc.Plug.AuthorizationCallback'], 'product': 'oidcc_plug', 'versions': [{'status': 'affected', 'version': '0.1.0-alpha.3', 'lessThan': '0.5.0', 'versionType': 'semver'}], 'packageURL': 'pkg:hex/oidcc_plug', 'packageName': 'oidcc_plug', 'programFiles': ['lib/oidcc/plug/authorize.ex', 'lib/oidcc/plug/authorization_callback.ex'], 'collectionURL': 'https://repo.hex.pm', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Oidcc.Plug.Authorize':call/2"}, {'name': "'Elixir.Oidcc.Plug.AuthorizationCallback':call/2"}]}, {'cpes': ['cpe:2.3:a:erlef:oidcc_plug:*:*:*:*:*:erlang:*:*'], 'repo': 'https://github.com/erlef/oidcc_plug', 'vendor': 'Erlang Ecosystem Foundation', 'modules': ['Elixir.Oidcc.Plug.Authorize', 'Elixir.Oidcc.Plug.AuthorizationCallback'], 'product': 'oidcc_plug', 'versions': [{'status': 'affected', 'version': '0a75fb139d8e2686d1b75e0d48962323d2181673', 'lessThan': 'f15e52c5750aaba701104b10ed96cfac063bd557', 'versionType': 'git'}], 'packageURL': 'pkg:github/erlef/oidcc_plug', 'packageName': 'erlef/oidcc_plug', 'programFiles': ['lib/oidcc/plug/authorize.ex', 'lib/oidcc/plug/authorization_callback.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Oidcc.Plug.Authorize':call/2"}, {'name': "'Elixir.Oidcc.Plug.AuthorizationCallback':call/2"}]}] Added Description Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files lib/oidcc/plug/authorize.ex and lib/oidcc/plug/authorization_callback.ex, and program routines Oidcc.Plug.Authorize.call/2 and Oidcc.Plug.AuthorizationCallback.call/2. Oidcc.Plug.Authorize.call/2 reads the initiating client's user agent with get_req_header(conn, "User-Agent"). Plug lowercases incoming header names, but get_req_header/2 matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and nil is written into the session. On the callback side, Oidcc.Plug.AuthorizationCallback treats a stored nil user agent as nothing to compare and returns :ok without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with check_useragent: true, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent. The impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled check_useragent are not affected in practice, since they never expected the binding. The corresponding lookup in Oidcc.Plug.AuthorizationCallback correctly uses the lowercase key and is not affected. This issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0. Added CVSS V4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-178 Added Reference https://cna.erlef.org/cves/CVE-2026-66883.html Added Reference https://github.com/erlef/oidcc_plug/commit/f15e52c5750aaba701104b10ed96cfac063bd557 Added Reference https://github.com/erlef/oidcc_plug/security/advisories/GHSA-w5r8-m75h-98fc Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-66883