CVE-2026-66883 in oidcc_plug
Summary
by MITRE • 08/04/2026
Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session.
This vulnerability is associated with program files lib/oidcc/plug/authorize.ex and lib/oidcc/plug/authorization_callback.ex, and program routines Oidcc.Plug.Authorize.call/2 and Oidcc.Plug.AuthorizationCallback.call/2.
Oidcc.Plug.Authorize.call/2 reads the initiating client's user agent with get_req_header(conn, "User-Agent"). Plug lowercases incoming header names, but get_req_header/2 matches the supplied key exactly and performs no normalization of its own, so the mixed-case lookup always returns an empty list and nil is written into the session. On the callback side, Oidcc.Plug.AuthorizationCallback treats a stored nil user agent as nothing to compare and returns :ok without inspecting the request. The two behaviours combine so that the check passes unconditionally on every request, including for deployments that explicitly opted in with check_useragent: true, and an authorization callback can be completed from a different user agent than the one that initiated the flow without detection. The check fails open silently, with no error and no log entry, so a deployment cannot tell the binding is absent.
The impact is limited to defense in depth. The inert check does not by itself allow an attacker to complete an authorization flow; it removes one layer that would otherwise hinder use of a stolen or leaked session, such as an exfiltrated session cookie replayed from a different client. The CSRF/state, nonce, and PKCE checks are unaffected and continue to function. Deployments that never enabled check_useragent are not affected in practice, since they never expected the binding. The corresponding lookup in Oidcc.Plug.AuthorizationCallback correctly uses the lowercase key and is not affected.
This issue affects oidcc_plug: from 0.1.0-alpha.3 before 0.5.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability described represents a critical improper handling of case sensitivity issue within the Erlang ecosystem's oidcc_plug library, specifically affecting the Oidcc.Plug.Authorize module. This flaw fundamentally undermines a security control mechanism designed to bind user sessions to specific client user agents, creating a significant bypass opportunity for attackers seeking to exploit stolen session tokens. The vulnerability manifests in the interaction between two core components: Oidcc.Plug.Authorize.call/2 and Oidcc.Plug.AuthorizationCallback.call/2, both of which process HTTP header information in ways that create inconsistent behavior regarding case sensitivity handling.
The technical implementation flaw occurs when Oidcc.Plug.Authorize.call/2 attempts to retrieve the User-Agent header using get_req_header(conn, "User-Agent") function call. This approach directly matches the supplied key without performing any normalization, while Plug framework itself lowercases all incoming header names during processing. The mismatch between case-sensitive lookup and case-normalized storage creates a scenario where mixed-case header requests return empty results, causing nil values to be stored in session data. This nil value subsequently propagates through the authorization flow, ultimately being treated as a valid condition by Oidcc.Plug.AuthorizationCallback.call/2 which performs no comparison when encountering nil user agent values.
This vulnerability aligns with CWE-706 Use of Incorrectly-Resolved Name or Reference, specifically manifesting as an improper handling of case sensitivity that creates a bypass mechanism. From an attack perspective, this flaw maps to ATT&CK technique T1531 Lateral Tool Transfer, where attackers can leverage stolen session tokens from different user agents than originally intended. The issue operates as a fail-open mechanism without logging or error reporting, making detection particularly challenging for security operations teams monitoring deployments. This silent failure mode represents a dangerous degradation of security controls that should have provided defense-in-depth against session replay attacks.
The operational impact extends beyond simple session hijacking scenarios to create potential for more sophisticated attacks involving session token leakage and reuse across different client contexts. While the vulnerability does not directly enable full authorization flow completion, it removes an important layer of protection that would otherwise hinder attackers attempting to replay stolen session cookies from alternative user agents. The affected components specifically include lib/oidcc/plug/authorize.ex and lib/oidcc/plug/authorization_callback.ex files, with the core issue occurring in Oidcc.Plug.Authorize.call/2 routine where header normalization fails and Oidcc.Plug.AuthorizationCallback.call/2 processes nil values without validation. The combination of these behaviors creates a complete bypass mechanism that affects all deployments using oidcc_plug versions between 0.1.0-alpha.3 and 0.5.0, though those deployments that never enabled check_useragent functionality remain practically unaffected since they never expected this binding behavior.
Security mitigation strategies should focus on updating to oidcc_plug version 0.5.0 or later where the case sensitivity handling has been corrected, ensuring all header lookups perform consistent normalization regardless of input case. Organizations should also implement monitoring for unauthorized user agent changes during active sessions and consider deploying additional detection mechanisms around session binding behaviors. The fix requires ensuring that header key lookups maintain consistent case handling throughout the authorization flow, particularly by normalizing header names to lowercase before comparison operations. Additionally, deployment teams should review their security configurations to ensure proper logging of session binding validation results and implement alerting for cases where user agent verification fails or returns nil values during authorization processes.