oidcc_plug vulnerabilities (Hex)

2 vulnerabilities.

• oidcc_plug Hex Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup CVE-2026-66883 Fix available 6.3 MediumAugust 4, 2026
• oidcc_plug Hex Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection CVE-2026-66884 Fix available 2.1 LowAugust 4, 2026