Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

roadiz/openid

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.7PackagistPublished

    OpenID Connect nonce generated but never validated — ID token replay attack

    CVE-2026-42206 · GHSA-3gx8-q682-38mx

    Affected
    • Packagist roadiz/openid >= 2.7.0, < 2.7.18; >= 2.6.0, < 2.6.31; >= 2.5.0, < 2.5.45; < 2.3.43
    Fixed in
    2.6.312.7.182.5.452.3.43· Vendor fix available
    Issue
    The roadiz/openid package generates an OIDC nonce in OAuth2LinkGenerator::generate() and includes it in the authorization request sent to the identity provider, but never stores it and never validates it on the callback. The OpenIdJwtConfigurationFactory validation chain does not include a nonce constraint, and OpenIdAuthenticator::authenticate() never checks the nonce claim in the returned ID token against a stored value. Details In src/OAuth2LinkGenerator.php, a nonce is created and sent to the IdP: However, this value is neither stored in session, cache, nor any other persistent store. In src/OpenIdJwtConfigurationFactory.php, the JWT validation constraints are: - LooseValidAt (expiry) - PermittedFor (audience) - IssuedBy (issuer) - HostedDomain (optional) - UserInfoEndpoint (optional) No nonce constraint is present. In src/Authentication/OpenIdAuthenticator.php, the authenticate() method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a…

    Recommended action: Upgrade to 2.7.18, 2.6.31, 2.5.45 or 2.3.43 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →