/ 
OIDC-Lite-0.01
/ OIDC::Lite::Client::Registration
Security Advisories (1)
CVE-2026-13089 (2026-07-22)

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self->alg($self->header->{alg}) from the token's own header and then calls decode_jwt(token, key, 1, [$self->alg]), handing JSON::WebToken an accepted-algorithm allowlist taken from the untrusted token. A token with alg=none yields ['none'], so decode_jwt returns the claims with no signature check, and a token with alg=HS256 is verified with the RP's RSA public key as the HMAC secret (RS to HS confusion). The ID Token is the OpenID Connect authentication assertion delivered to the Relying Party. Any caller that verifies an ID Token through the unpinned load(token)->verify path, or load(token, key) with only the key pinned, accepts a forged token carrying attacker-chosen claims such as sub and is authenticated as any user. Passing an explicit algorithm so $self->alg is already set bypasses the header-derived allowlist and is not affected. Note that the latest version uploaded to CPAN is 0.10. Later versions are available in the git repository.

NAME

OIDC::Lite::Client::Registration - OpenID Connect Dynamic Client Registration Client

SYNOPSIS

my $client = OIDC::Lite::Client::Registration->new(
    registration_endpoint   => q{op_registration_url},
);

my $config = {
    redirect_uris => q{https://openidconnect.info/rp},
    application_name => q{test_app_name},
};

my $your_app = shift;

# Client Registration

my $client_credential = $client->associate(
    metadata => $config,
) or return $your_app->error( $client->errstr );

$your_app->store->save( client_id                   => $client_credentials->client_id  );
$your_app->store->save( client_secret               => $client_credentials->client_secret );
$your_app->store->save( registration_access_token   => $client_credentials->registration_access_token );

# Client Update
my $updated_client = $client->update(
    access_token => $client_credential->registration_access_token,
    metadata => $config,
) or return $your_app->error( $client->errstr );

# Rotate Secret
my $client_credentials_new = $client->rotate_secret(
    access_token => $client_credential->registration_access_token,
) or return $your_app->error( $client->errstr );
$your_app->store->save( client_secret               => $client_credentials_new->client_secret );
$your_app->store->save( registration_access_token   => $client_credentials_new->registration_access_token );

DESCRIPTION

Client library for OpenID Connect Dynamic Client Registration

METHODS

new( %params )

registration_endpoint

Registration Endpoint URL

agent

user agent. if you omit this, LWP::UserAgent's object is set by default. You can use your custom agent or preset-agents.

See also

OAuth::Lite2::Agent::Dump OAuth::Lite2::Agent::Strict OAuth::Lite2::Agent::PSGIMock

associate( %params )

execute client association and returns OIDC::Lite::Client::Credential object.

access_token

Access Token obtained out of band to authorize the registrant.

metadata

Configuration parameters

update( %params )

execute client update and returns OIDC::Lite::Client::Credential object.

access_token

Registration Access Token returned by registration request

metadata

Configuration parameters

rotate_secret( %params )

execute rotate secret and returns OIDC::Lite::Client::Credential object.

access_token

Registration Access Token returned by registration request

last_request

Returns a HTTP::Request object that is used when you obtain or refresh access token last time internally.

last_request

Returns a HTTP::Response object that is used when you obtain or refresh access token last time internally.

AUTHOR

Ryo Ito, <ritou.06@gmail.com>

COPYRIGHT AND LICENSE

Copyright (C) 2012 by Ryo Ito

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.8 or, at your option, any later version of Perl 5 you may have available.