CVE-2026-66883 Erlang Ecosystem Foundation CVE debrief

Who should care

Defenders and developers using oidcc_plug versions from 0.1.0-alpha.3 before 0.5.0, especially those who explicitly opted in with check_useragent: true, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-66883 is a medium-severity vulnerability in oidcc_plug that removes a defense in depth control against replay of a stolen session, primarily affecting deployments that explicitly enabled user agent session binding.

• Defenders must verify and remediate this vulnerability to maintain defense in depth against session replay attacks
• Deployments with check_useragent: true may be exposed to unauthorized session usage
• Remediation priority is medium due to the defense in depth nature of the vulnerability

Technical summary

The Oidcc.Plug.Authorize.call/2 function reads the initiating client's user agent with get_req_header(conn, 'User-Agent') and writes nil into the session due to case sensitivity issues, while Oidcc.Plug.AuthorizationCallback treats a stored nil user agent as nothing to compare and returns :ok without inspecting the request. This results in the user agent session binding check being ineffective, allowing for potential replay of stolen sessions without detection, although other security measures like CSRF/state, nonce, and PKCE checks remain unaffected.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in oidcc_plug versions from 0.1.0-alpha.3 before 0.5.0, focusing on deployments that explicitly opted in with check_useragent: true.

Recommended defensive actions

• Verify oidcc_plug version and update to 0.5.0 or later if possible
• Review deployments that explicitly opted in with check_useragent: true for potential exposure
• Monitor for unusual authorization callback activity
• Perform an inventory of assets using oidcc_plug to identify potentially exposed systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets to ensure thorough resolution
• technicalSummary

Evidence notes

The vulnerability affects oidcc_plug versions from 0.1.0-alpha.3 before 0.5.0 and is limited to defense in depth, not allowing an attacker to complete an authorization flow by itself but removing one layer that hinders use of a stolen or leaked session.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.