Every CVE Search/ Get API key

CVE-2020-26244

Cryptographic issues in Python oic

6.8 MediumFix available

Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA none algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.83%Down 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.8

Cryptographic issues in Python oic

Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA none algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.

Record
CVE-2020-26244
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-325, CWE-347
Updated
2026-11-02
EUVDEUVD-2020-0119 6.8

Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA none algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.

Record
EUVD-2020-0119
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-4fjv-pmhg-3rfg 7.6

Multiple cryptographic issues in Python oic

Impact

  • Client implementations using this library

Issues

  1. The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg.
  2. JWA none algorithm was allowed in all flows.
  3. oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator.
  4. iat claim was not checked for sanity (i.e. it could be in the future)

Patches

  1. IdToken signature is now always checked.
  2. JWA none algorithm is now allowed only if using the response_type code
  3. IdToken verification is now done automatically.
  4. iat claim is now checked for sanity.
Record
GHSA-4fjv-pmhg-3rfg
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-325, CWE-347
Updated
2026-11-02
NVD 6.8

Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA none algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.

Record
CVE-2020-26244
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
4.9 MediumAV:N/AC:M/Au:S/C:P/I:P/A:N
Weakness
CWE-325, CWE-347
Updated
2026-11-02
OSV 6.8

Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA none algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.

Record
CVE-2020-26244
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVGHSA-4fjv-pmhg-3rfg 7.6

Multiple cryptographic issues in Python oic

Impact

  • Client implementations using this library

Issues

  1. The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg.
  2. JWA none algorithm was allowed in all flows.
  3. oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator.
  4. iat claim was not checked for sanity (i.e. it could be in the future)

Patches

  1. IdToken signature is now always checked.
  2. JWA none algorithm is now allowed only if using the response_type code
  3. IdToken verification is now done automatically.
  4. iat claim is now checked for sanity.
Record
GHSA-4fjv-pmhg-3rfg
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-325, CWE-347
Updated
2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:11244-1 No score

python36-oic-1.2.1-1.2 on GA media

These are all security issues fixed in the python36-oic-1.2.1-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11244-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14150-1 No score

python310-oic-1.5.0-1.8 on GA media

These are all security issues fixed in the python310-oic-1.5.0-1.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14150-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12021-1 No score

python313-oic-1.7.0-2.4 on GA media

These are all security issues fixed in the python313-oic-1.7.0-2.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12021-1
Updated
2026-11-02
OSVPYSEC-2020-69 No score

Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA none algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.

Record
PYSEC-2020-69
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
oic
PyPI
 before 1.2.1
1.2.1
oic
PyPI
 before 1.2.1, plus listed versions
0.10.0.00.11.0.00.11.0.10.12.00.13.0
Show 30 moreShow less
0.13.10.14.00.15.00.15.10.4.00.5.00.6.00.7.00.7.20.7.30.7.40.7.50.7.60.7.70.7.80.8.10.8.20.8.30.8.4.00.8.5.00.9.0.00.9.1.00.9.4.00.9.5.01.0.01.0.11.1.01.1.11.1.21.2.0
1.2.1
oic
PyPI
 before 1.2.1, plus listed versions
0.4.00.5.00.6.00.7.00.7.2
Show 30 moreShow less
0.7.30.7.40.7.50.7.60.7.70.7.80.8.10.8.20.8.30.8.4.00.8.5.00.9.0.00.9.1.00.9.4.00.9.5.00.10.0.00.11.0.00.11.0.10.12.00.13.00.13.10.14.00.15.00.15.11.0.01.0.11.1.01.1.11.1.21.2.0
1.2.1
python-oic
openSUSE:Tumbleweed
 before 1.5.0-1.8
1.5.0-1.8
python-oic
openSUSE:Tumbleweed
 before 1.7.0-2.4
1.7.0-2.4

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-26244 is a medium vulnerability (CVSS 6.8) in Python Openid Connect Project Openid Connect, published December 2, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in oic 1.2.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open