---
id: CVE-2020-26244
aliases:
  - GHSA-4fjv-pmhg-3rfg
  - PYSEC-2020-69
title: Multiple cryptographic issues in Python oic
summary: Multiple cryptographic issues in Python oic
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'
vendor: oic
product: oic
ecosystem: pip
affected:
  - oic < 1.2.1
patched:
  - oic 1.2.1
published: '2020-12-04'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4fjv-pmhg-3rfg'
references:
  - url: 'https://github.com/OpenIDC/pyoidc/security/advisories/GHSA-4fjv-pmhg-3rfg'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-26244'
  - url: >-
      https://github.com/OpenIDC/pyoidc/commit/62f8d753fa17c8b1f29f8be639cf0b33afb02498
  - url: 'https://github.com/OpenIDC/pyoidc'
  - url: 'https://github.com/OpenIDC/pyoidc/releases/tag/1.2.1'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/oic/PYSEC-2020-69.yaml
  - url: 'https://pypi.org/project/oic'
tags:
  - osv
  - pip
epss: 0.00832
epssPercentile: 0.55831
ingestedAt: '2026-07-08T18:25:45.477Z'
---

## Overview

### Impact
* Client implementations using this library

### Issues
1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg.
2) JWA `none` algorithm was allowed in all flows.
3) `oic.consumer.Consumer.parse_authz` returns an unverified IdToken. The verification of the token was left to the discretion of the implementator.
4) `iat` claim was not checked for sanity (i.e. it could be in the future)

### Patches
1) IdToken signature is now always checked.
2) JWA `none` algorithm is now allowed only if using the `response_type` `code`
3) IdToken verification is now done automatically.
4) `iat` claim is now checked for sanity.

## Affected packages

- `oic < 1.2.1`

## Remediation

Upgrade to a patched release:

- `oic 1.2.1`