CVE-2020-26244: openidc pyoidc Missing Cryptographic Step
Vulnerability summary
CVE-2020-26244 is a medium (CVSS 6.8) Missing Cryptographic Step vulnerability in openidc pyoidc. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 56.9% of scored vulnerabilities.
Timeline
- 02-12-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA `none` algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · PypiEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- NVDNIST6.8MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.83%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
0.00 pp
From 0.83% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-325Missing Cryptographic StepThe product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
- CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected systems
Openidc1 product
- pyoidc< 1.2.1
Opensuse1 product
- python-oic&distro=openSUSE Tumbleweed< 1.5.0-1.8 | < 1.7.0-2.4
PyPI1 product
- oic< 62f8d753fa17c8b1f29f8be639cf0b33afb02498 | < 1.2.1
Python_openid_connect_project1 product
- python_openid_connect< 1.2.1
4 vendors · 4 products
References
9 links- github.com/OpenIDC/pyoidc/security/advisories/GHSA-4fjv-pmhg-3rfgX Refsource CONFIRMWEBAdvisoryThird Party Advisory
- github.com/OpenIDC/pyoidc/commit/62f8d753fa17c8b1f29f8be639cf0b33afb02498X Refsource MISCWEBFIXPatchThird Party Advisory
- github.com/OpenIDC/pyoidcPACKAGE