CVE-2026-75759 erlef CVE debrief

Who should care

Organizations using erlef oidcc should prioritize defensive actions to address the vulnerability. This includes verifying inventory, applying vendor remediation, and implementing compensating controls. The vulnerability has a high impact on confidentiality, integrity, and availability, and is considered a High-priority defensive action.

Technical summary

The vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. This is due to the incorrect verification of cryptographic signatures, which can be exploited by anyone holding the relying party's public encryption key. The vulnerability affects oidcc: from 3.2.0-beta.1 before 3.9.0. The issue is caused by the fallback to parsing plaintext claims and returning them with no verifying key in oidcc_jwt_util:verify_decrypted_token/4, and the matching on the JOSE structure type rather than on whether a signature had been verified in oidcc_token:int_validate_jwt/4.

Defensive priority

High-priority defensive actions are required to address the Improper Verification of Cryptographic Signature vulnerability in erlef oidcc. Organizations should verify their inventory, apply vendor remediation, and implement compensating controls.

Recommended defensive actions

• Verify inventory of oidcc installations and apply vendor remediation
• Implement compensating controls, such as validating signatures and encryption
• Monitor for suspicious activity and exception tracking
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. Evidence is based on official CVE Program record, NIST NVD detail page, and source-specific vulnerability assessment. The CVE record was published on 2026-08-30T02:18:30.110Z and has not been modified since then. The vulnerability has a CVSS score of 7.6 and is classified as HIGH severity. The affected product is erlef oidcc, and the vulnerability affects versions from 3.2.0-beta.1 before 3.9.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.