CVE-2026-13089

OIDC::Lite for Perl up to 0.12.1 is vulnerable to ID Token signature verification bypass via an unpinned algorithm allowlist. If the caller does not pin the alg, verify uses the token header alg and passes it to decode_jwt with an allowlist from the untrusted token, allowing tokens with alg: none...