CVE-2026-66884 Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.AuthorizationCallback module allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file...