CVE-2026-55954

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55954

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55954.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55954

Aliases

EEF-CVE-2026-55954
GHSA-pxx8-68pc-p9mr

Published

2026-07-14T15:08:26.051Z

Modified

2026-07-15T02:21:03.326050272Z

Severity

9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Missing ID token claim validation in ueberauth_apple allows account takeover

Details

Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims.

The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback idtoken against Apple's JWKS but does not validate any registered claims. The iss, aud, exp, and iat claims are read from the token and passed on to Ueberauth.Strategy.Apple.handlecallback!/1, which derives the logged-in user's uid and email directly from the unvalidated sub claim.

An attacker who obtains any Apple-signed ID token bearing the victim's sub (via a captured expired token, or via an ID token issued to a sibling client in the same Apple developer team) can replay it against the vulnerable callback and be authenticated as the victim. The absent exp check makes stolen tokens usable indefinitely, and the absent aud check enables cross-application account takeover across clients that share an Apple developer team.

This issue affects ueberauth_apple: from 0.1.0 before 0.6.2.

Database specific

{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-290"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3908a187d045c75994b62ce340c3aa26bb8976b8"
                },
                {
                    "fixed": "01e2d9c9b3134e1b78633ad82d136d5ff4a61f28"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55954.json"
}

References

Affected packages

Git / github.com/ueberauth/ueberauth_apple

Affected ranges

Type

GIT

Repo

https://github.com/ueberauth/ueberauth_apple

Events

Introduced

Fixed

01e2d9c9b3134e1b78633ad82d136d5ff4a61f28

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "fixed": "0.6.2"
        }
    ]
}

Affected versions

0.*

0.6.0

0.6.0-rc.0

0.6.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55954.json"