CVE-2026-13089

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-13089
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13089.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-13089
Published
2026-07-22T20:31:23.693Z
Modified
2026-07-25T03:56:38.439353399Z
Summary
OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify
Details

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify.

When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self->alg($self->header->{alg}) from the token's own header and then calls decodejwt(token, key, 1, [$self->alg]), handing JSON::WebToken an accepted-algorithm allowlist taken from the untrusted token. A token with alg=none yields ['none'], so decodejwt returns the claims with no signature check, and a token with alg=HS256 is verified with the RP's RSA public key as the HMAC secret (RS to HS confusion).

The ID Token is the OpenID Connect authentication assertion delivered to the Relying Party. Any caller that verifies an ID Token through the unpinned load(token)->verify path, or load(token, key) with only the key pinned, accepts a forged token carrying attacker-chosen claims such as sub and is authenticated as any user. Passing an explicit algorithm so $self->alg is already set bypasses the header-derived allowlist and is not affected.

Note that the latest version uploaded to CPAN is 0.10. Later versions are available in the git repository.

Database specific 
{
    "cwe_ids": [
        "CWE-347"
    ],
    "cna_assigner": "CPANSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13089.json"
}
References

Affected packages

Git / github.com/ritou/p5-oidc-lite

Affected ranges

Type
GIT
Repo
https://github.com/ritou/p5-oidc-lite
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bdae183fc0532da22a8191478d41bfa0f120a988
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.12.1"
        },
        {
            "fixed": "0.12.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*
0.04
0.05
0.06
0.08
0.09
0.10
0.11
0.12

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13089.json"