CVE-2020-26244

CVE-2020-26244 affects Python oic (OpenID Connect) before version 1.2.1. The issues include: IdToken signature algorithm not always checked, JWA none allowed in all flows, oic.consumer.Consumer.parse_authz returning an unverified IdToken, and iat not checked for sanity. A fix is released in versi...

CVE-2020-26244 Cryptographic issues in Python oic

Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1 The IdToken signature algorithm was not checked automatically, but only if the expected...