CVEspow-authCVE-2026-117656Published Oct 30, 23:55 · Updated Oct 30, 23:55 UTC
9.3
CriticalCVSS 4.0 · from EEF
CVE-2026-117656

Unverified Sign in with Apple callback parameter can override verified ID token claims

assent · CWE-290 · CWE-290
Affectedassent, pow-auth/assent
FixUpdate to 0.3.2, 18898bde0296152165ae470078490e5798329b1b or newer
PublishedOct 30, 23:55 · EEF
ScoredOct 30 · 9.3 · EEF
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC

What we know

No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read data and change data. CVSS impact.

Description

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback endpoint in a user form parameter that the browser submits and the client controls. Assent.Strategy.Apple.callback/2 in lib/assent/strategies/apple.ex decodes that parameter, and fetch_user/2 merges it over the claims of the verified ID token, so the unverified map wins. An attacker who completes a Sign in with Apple login with their own Apple ID and edits the user parameter can replace sub, email, and any other claim. Applications that look up, link, or authorize accounts by the returned subject or email then act on the attacker's values. This issue affects assent: from 0.1.25 before 0.3.2.

From EEF

Affected and fixed versions

ProductAffectedFixed inassent0.1.25 – before 0.3.20.3.2pow-auth/assenta2d331e8c51376d6c0b04a81aad31e0b4d4d64a3 – before 18898bde0296152165ae470078490e5798329b1b18898bde0296152165ae470078490e5798329b1b

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

Unverified Sign in with Apple callback parameter can override verified ID token claims · github.comvendor advisoryrelatedEEF CNA record for CVE-2026-117656 · cna.erlef.orgrelatedOSV record EEF-CVE-2026-117656 · osv.devrelatedIntroducing commit a2d331e in pow-auth/assent · github.comrelatedFix commit 18898bd in pow-auth/assent · github.compatch