Security Bulletin: Due to use of pac4j, IBM Cloud PAK for Watson AI Ops is vulnerable to token bypass (CVE-2021-44878)

Summary If an OpenID Connect provider supports the "none" algorithm i.e., tokens with no signature, pac4j v5.3.0 and prior does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none"...

CVE-2021-44878

Summary: CVE-2021-44878 affects pac4j (v5.3.0 and earlier) where an OpenID Connect provider that supports the “none” algorithm can bypass token validation by injecting an ID token with alg: none and empty signature, violating OpenID Core specifications. The vulnerability enables bypassing token v...