ueberauth ueberauth_apple up to 0.6.1 Apple Authentication Strategy payload sub authentication replay

Summaryinfo

A vulnerability was found in ueberauth ueberauth_apple up to 0.6.1. It has been rated as critical. This impacts the function payload of the component Apple Authentication Strategy. This manipulation of the argument sub causes authentication replay. This vulnerability appears as CVE-2026-55954. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in ueberauth ueberauth_apple up to 0.6.1. Affected by this vulnerability is the function payload of the component Apple Authentication Strategy. The manipulation of the argument sub with an unknown input leads to a authentication replay vulnerability. The CWE definition for the vulnerability is CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback id_token against Apple's JWKS but does not validate any registered claims. The iss, aud, exp, and iat claims are read from the token and passed on to Ueberauth.Strategy.Apple.handle_callback!/1, which derives the logged-in user's uid and email directly from the unvalidated sub claim. An attacker who obtains any Apple-signed ID token bearing the victim's sub (via a captured expired token, or via an ID token issued to a sibling client in the same Apple developer team) can replay it against the vulnerable callback and be authenticated as the victim. The absent exp check makes stolen tokens usable indefinitely, and the absent aud check enables cross-application account takeover across clients that share an Apple developer team. This issue affects ueberauth_apple: from 0.1.0 before 0.6.2.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-55954 since 06/17/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1040 according to MITRE ATT&CK.

Upgrading to version 0.6.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• ueberauth

Name

• ueberauth_apple

Version

• 0.6.0
• 0.6.1

Website

• Product: https://github.com/ueberauth/ueberauth_apple/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion