점검 대응높음KEV 미등록
CVE-2026-13089
RITOU OIDC::Lite 취약점
OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self->alg($self->header->{alg}) from the token's own header and then calls decode_jwt(token, key, 1, [$self->alg]), handing JSON::WebToken an accepted-algorithm allowlist taken from the untrusted token. A token with alg=none yields ['none'], so decode_jwt returns the claims with no signature check, and a token with alg=HS256 is verified with the RP's RSA public key as...
- 대응 우선순위
- 점검
- CVSS
- 7.5
- EPSS
- 0.24% 백분위 15.3% · 2026.08.01 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.07.23