CVE-2026-55954: ueberauth_apple 0.1.0 to before 0.6.2

Affected technology

ueberauth_apple · 0.1.0 to before 0.6.2
ueberauth

ueberauth_apple · 3908a187d045c75994b62ce340c3aa26bb8976b8 to before 01e2d9c9b3134e1b78633ad82d136d5ff4a61f28
ueberauth

Component: 'Elixir.Ueberauth.Strategy.Apple', 'Elixir.Ueberauth.Strategy.Apple.Token'
Function: 'Elixir.Ueberauth.Strategy.Apple':handle_callback!/1, 'Elixir.Ueberauth.Strategy.Apple.Token':payload/2
File: lib/ueberauth/strategy/apple.ex, lib/ueberauth/strategy/apple/token.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could get past authentication checks under the conditions described by the source. Source advisory’s CVSS 4.0 assessment (base score 9.1/10) rates confidentiality and integrity impact as high; availability impact as none.