A Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug allows an attacker to trick a victim's browser into completing an authorization flow the victim never initiated, potentially leading to account takeover. This issue affects oidcc_plug versions from 0.2.0-beta.1 before 0.5.0. Defenders of applications using oidcc_plug, especially those reusing one callback for both signing [truncated]
MEDIUMErlang Ecosystem FoundationCVE published 2026-08-04
CVE-2026-66883 Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This affects oidcc_plug versions from 0.1.0-alpha.3 before 0.5.0, particularly impacting deployments that explicitly enabled user agent session binding [truncated]
