CVE-2026-66884: oidcc_plug 0.2.0-beta.1 to before 0.5.0

Affected technology

oidcc_plug · 0.2.0-beta.1 to before 0.5.0
Erlang Ecosystem Foundation

oidcc_plug · e577ae73b9080693442916043a22d8f05491dd93 to before 97d75afc57826dca31989b47d6e2a3c136039917
Erlang Ecosystem Foundation

Component: Elixir.Oidcc.Plug.AuthorizationCallback
Function: 'Elixir.Oidcc.Plug.AuthorizationCallback':call/2
File: lib/oidcc/plug/authorization_callback.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

An attacker can make a victim's browser complete an authorization flow the victim never initiated. Source advisory’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality and integrity impact as low; availability impact as none.