CVE-2020-26244Medium· 6.8▾ Sunlit

Multiple cryptographic issues in Python oic

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score38/ 100 · Low

impact 37.4 · likelihood 0.2 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Dec 4, 2020

Updated

Jul 8, 2026

CVSS

6.8

Vendor

oic

Product

oic

CWE

—

Depth score

38 · Low

EPSS

0.83% · p56

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Jul 8.

0.8% → 0.8%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 2092 days

Dec 4, 2020Published
Disclosed via OSV
Jul 8, 2026Record revised
Last analysed / modified upstream
Jul 8, 2026EPSS first tracked
0.8%
Aug 27, 2026EPSS peak
0.8% → 0.8%

oic #osv #pip

Affected

oic < 1.2.1

Patched in

oic 1.2.1

Full technical detail▾

Overview

Impact

Client implementations using this library

Issues

The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg.
JWA none algorithm was allowed in all flows.
oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator.
iat claim was not checked for sanity (i.e. it could be in the future)

Patches

IdToken signature is now always checked.
JWA none algorithm is now allowed only if using the response_type code
IdToken verification is now done automatically.
iat claim is now checked for sanity.

Affected packages

oic < 1.2.1

Remediation

Upgrade to a patched release:

oic 1.2.1

References

#osv#pip

Overview

Impact

Client implementations using this library

Issues

The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg.

JWA none algorithm was allowed in all flows.

oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator.

iat claim was not checked for sanity (i.e. it could be in the future)

Patches

IdToken signature is now always checked.

JWA none algorithm is now allowed only if using the response_type code

IdToken verification is now done automatically.

iat claim is now checked for sanity.