← Back to CVE Explorer

CVE-2026-55954

Full vulnerability record from the local CVENow database.

Description

Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback id_token against Apple's JWKS but does not validate any registered claims. The iss, aud, exp, and iat claims are read from the token and passed on to Ueberauth.Strategy.Apple.handle_callback!/1, which derives the logged-in user's uid and email directly from the unvalidated sub claim. An attacker who obtains any Apple-signed ID token bearing the victim's sub (via a captured expired token, or via an ID token issued to a sibling client in the same Apple developer team) can replay it against the vulnerable callback and be authenticated as the victim. The absent exp check makes stolen tokens usable indefinitely, and the absent aud check enables cross-application account takeover across clients that share an Apple developer team. This issue affects ueberauth_apple: from 0.1.0 before 0.6.2.

Severity
CRITICAL
CVSS score
9.1 (v4.0)
Vulnerability status
Deferred
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-07-14 16:17:01.093000
Last modified
2026-10-24 21:10:00.130000
View original CVE JSON 
{
  "id": "CVE-2026-55954",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-07-14T16:17:01.093",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims.\n\nThe Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback id_token against Apple's JWKS but does not validate any registered claims. The iss, aud, exp, and iat claims are read from the token and passed on to Ueberauth.Strategy.Apple.handle_callback!/1, which derives the logged-in user's uid and email directly from the unvalidated sub claim.\n\nAn attacker who obtains any Apple-signed ID token bearing the victim's sub (via a captured expired token, or via an ID token issued to a sibling client in the same Apple developer team) can replay it against the vulnerable callback and be authenticated as the victim. The absent exp check makes stolen tokens usable indefinitely, and the absent aud check enables cross-application account takeover across clients that share an Apple developer team.\n\nThis issue affects ueberauth_apple: from 0.1.0 before 0.6.2."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de omisión de autenticación por suplantación en ueberauth ueberauth_apple permite la toma de control de cuenta a través de reclamaciones de token de ID no validadas.\n\nLa función Ueberauth.Strategy.Apple.Token.payload/2 verifica la firma JWT del id_token de la devolución de llamada contra el JWKS de Apple, pero no valida ninguna reclamación registrada. Las reclamaciones iss, aud, exp e iat se leen del token y se pasan a Ueberauth.Strategy.Apple.handle_callback!/1, que deriva el uid y el correo electrónico del usuario autenticado directamente de la reclamación sub no validada.\n\nUn atacante que obtiene cualquier token de ID firmado por Apple que contenga el sub de la víctima (a través de un token caducado capturado, o a través de un token de ID emitido a un cliente hermano en el mismo equipo de desarrolladores de Apple) puede reproducirlo contra la devolución de llamada vulnerable y ser autenticado como la víctima. La ausencia de verificación de exp hace que los tokens robados sean utilizables indefinidamente, y la ausencia de verificación de aud permite la toma de control de cuenta entre aplicaciones en clientes que comparten un equipo de desarrolladores de Apple.\n\nEste problema afecta a ueberauth_apple: desde 0.1.0 antes de 0.6.2."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "ueberauth",
          "product": "ueberauth_apple",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "ueberauth_apple",
          "cpes": [
            "cpe:2.3:a:ueberauth:ueberauth_apple:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Ueberauth.Strategy.Apple'",
            "'Elixir.Ueberauth.Strategy.Apple.Token'"
          ],
          "programFiles": [
            "lib/ueberauth/strategy/apple.ex",
            "lib/ueberauth/strategy/apple/token.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Ueberauth.Strategy.Apple':handle_callback!/1"
            },
            {
              "name": "'Elixir.Ueberauth.Strategy.Apple.Token':payload/2"
            }
          ],
          "repo": "https://github.com/ueberauth/ueberauth_apple",
          "packageURL": "pkg:hex/ueberauth_apple",
          "versions": [
            {
              "version": "0.1.0",
              "lessThan": "0.6.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "ueberauth",
          "product": "ueberauth_apple",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "ueberauth/ueberauth_apple",
          "cpes": [
            "cpe:2.3:a:ueberauth:ueberauth_apple:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Ueberauth.Strategy.Apple'",
            "'Elixir.Ueberauth.Strategy.Apple.Token'"
          ],
          "programFiles": [
            "lib/ueberauth/strategy/apple.ex",
            "lib/ueberauth/strategy/apple/token.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Ueberauth.Strategy.Apple':handle_callback!/1"
            },
            {
              "name": "'Elixir.Ueberauth.Strategy.Apple.Token':payload/2"
            }
          ],
          "repo": "https://github.com/ueberauth/ueberauth_apple",
          "packageURL": "pkg:github/ueberauth/ueberauth_apple",
          "versions": [
            {
              "version": "3908a187d045c75994b62ce340c3aa26bb8976b8",
              "lessThan": "01e2d9c9b3134e1b78633ad82d136d5ff4a61f28",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-14T15:56:35.178814Z",
          "id": "CVE-2026-55954",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-55954.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ueberauth/ueberauth_apple/commit/01e2d9c9b3134e1b78633ad82d136d5ff4a61f28",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ueberauth/ueberauth_apple/security/advisories/GHSA-pxx8-68pc-p9mr",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-55954",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ueberauth/ueberauth_apple/security/advisories/GHSA-pxx8-68pc-p9mr",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}