critical9.3
CVE-2026-117656Fix available
Unverified Sign in with Apple callback parameter can override verified ID token claims
assent Hex
| Affected range | Recorded fix |
|---|---|
| From 0.1.25 before 0.3.2Semantic versions | 0.3.2 |
Version evidence: OSV · EEF-CVE-2026-117656
View original version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0.1.25"
},
{
"fixed": "0.3.2"
}
],
"type": "SEMVER"
}
],
"versions": [
"0.1.25",
"0.1.26",
"0.1.27",
"0.1.28",
"0.2.0",
"0.2.1",
"0.2.10",
"0.2.11",
"0.2.12",
"0.2.13",
"0.2.2",
"0.2.3",
"0.2.4",
"0.2.5",
"0.2.6",
"0.2.7",
"0.2.8",
"0.2.9",
"0.3.0",
"0.3.1"
]
}