Fail close at validating c_hash and at_hash
fix(oidc): fail close at validating c_hash and at_hash
Fail close at validating c_hash and at_hashb9bb2b-fix-fail-close-at-validating-c-hash-cve-2026-28498fixfail close validating hash oidc
Committed by lepture
commit message
fix(oidc): fail close at validating c_hash and at_hashEditor assessment
This commit patches CVE-2026-28498. The one-line subject 'fix(oidc): fail close at validating c_hash and at_hash' points at the exact OIDC claims and signals a fail-closed posture, so the security direction is obvious. Two flaws keep it thin: 'fail close' should read 'fail closed', and there is no body describing what happened before the change—presumably mismatched hashes were accepted or validation errors were swallowed. The oidc scope and fix type are accurate. No tests, references, or footers accompany it. A reader can act on the subject but cannot learn the failure mode, which is the point of a good security commit.