CVE-2026-42206: 
PHP vulnerability analysis and mitigation

CVE-2026-42206 is an OpenID Connect (OIDC) nonce validation failure in the roadiz/openid Composer package that enables ID token replay and token injection attacks. The package generates a nonce during the authorization request but never stores or validates it on the callback, violating OIDC Core 1.0 Section 3.1.3.7. Affected versions include roadiz/openid < 2.3.43, >= 2.5.0 and < 2.5.45, >= 2.6.0 and < 2.6.31, and >= 2.7.0 and < 2.7.18. It was first published by the maintainer on April 22, 2026, added to the GitHub Advisory Database on April 29, 2026, and published by NVD on May 8, 2026. The CVSS v4.0 base score is 5.7 (Medium) (GitHub Advisory).

The root cause is CWE-345 (Insufficient Verification of Data Authenticity): in src/OAuth2LinkGenerator.php, a nonce is generated via $this->tokenGenerator->generateToken() and sent to the identity provider, but is never persisted to session, cache, or any other store. The OpenIdJwtConfigurationFactory validation chain in src/OpenIdJwtConfigurationFactory.php only enforces expiry (LooseValidAt), audience (PermittedFor), and issuer (IssuedBy) constraints — no nonce constraint is present. Consequently, OpenIdAuthenticator::authenticate() in src/Authentication/OpenIdAuthenticator.php never retrieves a stored nonce or compares it against the nonce claim in the returned ID token, meaning any non-expired, otherwise-valid ID token will be accepted regardless of which session or flow it originated from (GitHub Advisory, Roadiz Advisory).

Successful exploitation allows an attacker to authenticate as a victim user by replaying a valid but intercepted ID token within its validity window, directly impacting integrity by enabling unauthorized account access. Additionally, a malicious or compromised identity provider can inject tokens with mismatched nonces across concurrent sessions, and the application will silently accept them. Any Roadiz application using the roadiz/openid package with OpenID Connect SSO is affected, potentially exposing all SSO-authenticated user accounts to session hijacking (GitHub Advisory).

A proof-of-concept exploitation path is publicly documented in the GitHub Security Advisory, describing token interception and replay steps. The vulnerability requires low privileges (a valid OIDC account in the same IdP) and no user interaction, but does require obtaining a valid ID token through interception or leakage. There is no evidence of in-the-wild exploitation, no CISA KEV listing, and no known threat actor attribution. The EPSS score is approximately 0.019–0.024% (7th percentile), indicating low near-term exploitation probability (GitHub Advisory).

1. Reconnaissance: Identify a target Roadiz application using OpenID Connect SSO with an affected version of roadiz/openid (< 2.3.43, < 2.5.45, < 2.6.31, or < 2.7.18).
2. Obtain a valid ID token: Acquire a legitimate ID token for the target user through one of the following means: network interception on a non-HTTPS redirect, browser history or referrer header leakage, or control of a malicious/compromised identity provider.
3. Replay the ID token: Submit the intercepted ID token to the Roadiz OIDC callback endpoint. Because OpenIdAuthenticator::authenticate() never checks the nonce claim against a stored value, the token passes all validation constraints (expiry, audience, issuer) as long as it has not expired.
4. Achieve authentication as victim: The application accepts the replayed token and establishes an authenticated session for the attacker as the victim user, granting access to all resources and actions available to that account.
5. (Alternative — token injection): If operating as or with access to a malicious IdP, inject an ID token with a nonce that does not match any client-generated value into an active authorization code flow; the application will silently accept it, allowing cross-session token injection (GitHub Advisory, Roadiz Advisory).

• Logs: Authentication events in application logs showing successful OIDC logins from unexpected IP addresses or at unusual times for a given user account; repeated OIDC callback requests with the same id_token value across different sessions or source IPs.
• Network: Multiple OIDC callback requests (/openid/callback or equivalent endpoint) carrying identical JWT tokens from different client IPs within the token's validity window; OIDC callback requests arriving without a preceding authorization redirect from the same session.
• Application Behavior: Concurrent active sessions for the same user account originating from geographically or temporally inconsistent locations; user account activity that the legitimate user did not initiate, visible in audit or access logs.

Upgrade roadiz/openid to one of the patched versions: 2.7.18, 2.6.31, 2.5.45, or 2.3.43, depending on the branch in use. No configuration-based workaround is available since the flaw is in the authentication logic itself; upgrading is the only effective remediation. As an interim measure, organizations should ensure all OIDC traffic uses HTTPS exclusively to reduce the risk of token interception, and monitor for anomalous authentication patterns (GitHub Advisory, Roadiz Advisory).

The vulnerability was reported by security researcher athuljayaram and published by Roadiz maintainer ambroisemaupate on April 22, 2026. A Bluesky post from the CVE tracking account noted the disclosure shortly after publication. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).