CVE-2026-66884 Erlang Ecosystem Foundation CVE debrief

Who should care

Defenders of applications using oidcc_plug, especially those reusing one callback for both signing in and linking a provider account, should assess exposure and prioritize patching and compensating controls.

Why it matters

CVE-2026-66884 is a Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug that allows attackers to trick victims into completing unauthorized authorization flows, potentially leading to account takeover. Defenders should prioritize patching and assessing exposure in vulnerable applications.

• Account takeover through induced authorization flow completion
• Potential for unauthorized access to victim's account actions
• Need for verification of patch application and compensating controls
• Possible exposure in applications with shared callback for sign-in and account linking

Technical summary

The Oidcc.Plug.AuthorizationCallback module in oidcc_plug has a vulnerability that allows an attacker to make a victim's browser complete an authorization flow the victim never initiated, due to a permissive fallback when no Oidcc.Plug.Authorize session is present. This permissive fallback causes the nonce, state, PKCE, peer IP and user agent checks to be skipped. An attacker can obtain an authorization code for their own provider account, then induce the victim to visit the callback endpoint with that code and no state parameter, potentially leading to account takeover.

Defensive priority

Defenders should prioritize verifying and applying patches for oidcc_plug versions between 0.2.0-beta.1 and before 0.5.0, and assess exposure in applications reusing one callback for both signing in and linking a provider account.

Recommended defensive actions

• Verify and apply patches for oidcc_plug versions between 0.2.0-beta.1 and before 0.5.0
• Assess exposure in applications reusing one callback for both signing in and linking a provider account
• Implement compensating controls to detect and prevent CSRF attacks
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and references to source-specific vulnerability assessments. The vulnerability allows an attacker to make a victim's browser complete an authorization flow the victim never initiated due to a permissive fallback when no Oidcc.Plug.Authorize session is present. The permissive fallback serves no conforming flow. Third-party-initiated login reaches a relying party at a separate login initiation endpoint and causes it to send a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.