CVE-2026-13089

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify.<br /> <br /> When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self-&gt;alg($self-&gt;header-&gt;{alg}) from the token&amp;#39;s own header and then calls decode_jwt(token, key, 1, [$self-&gt;alg]), handing JSON::WebToken an accepted-algorithm allowlist taken from the untrusted token. A token with alg=none yields [&amp;#39;none&amp;#39;], so decode_jwt returns the claims with no signature check, and a token with alg=HS256 is verified with the RP&amp;#39;s RSA public key as the HMAC secret (RS to HS confusion).<br /> <br /> The ID Token is the OpenID Connect authentication assertion delivered to the Relying Party. Any caller that verifies an ID Token through the unpinned load(token)-&gt;verify path, or load(token, key) with only the key pinned, accepts a forged token carrying attacker-chosen claims such as sub and is authenticated as any user. Passing an explicit algorithm so $self-&gt;alg is already set bypasses the header-derived allowlist and is not affected.<br /> <br /> Note that the latest version uploaded to CPAN is 0.10. Later versions are available in the git repository.