Description

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-13T17:17:24.750Z",
  "pubdate": "2026-08-13T17:17:24.750Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the OpenID Connect (OIDC) userinfo endpoint, specifically regarding the failure to enforce API token scopes. This security flaw allows entities possessing valid tokens with restricted or absent scopes to successfully query the userinfo endpoint and retrieve sensitive identity claims that should otherwise be restricted. The impact of this vulnerability includes unauthorized information disclosure, privacy violations, and potential exposure of personally identifiable information (PII) or internal user attributes to unauthorized clients. Affected systems include implementations of OIDC authorization servers and identity providers that fail to validate token scopes during userinfo requests. The risk implication is significant as it undermines the principle of least privilege and scope-based access control mechanisms within federated authentication architectures. The capability required by an attacker involves obtaining a valid token, which may be acquired through standard authentication flows, and subsequently presenting this token to the userinfo endpoint without possessing the requisite authorization scopes. Exploitation requirements rely entirely on the misconfiguration or programmatic oversight within the identity provider where scope validation logic is omitted during the processing of incoming userinfo requests.",
  "technicalDetails": "The root cause of this vulnerability stems from a validation oversight in the OIDC userinfo endpoint implementation, where the server fails to verify whether the presented access token contains the necessary scopes—such as openid, profile, or email—before returning identity claims. In a secure OIDC deployment, the userinfo endpoint is designed to act as a protected resource that evaluates the claims and scopes bound to the incoming bearer token. When a client application submits a request to the userinfo endpoint, the underlying authorization framework must inspect the token's scope parameter to ensure the client is explicitly authorized to access specific user attributes. In the vulnerable scenario, the endpoint bypasses scope enforcement entirely, treating any syntactically valid and unexpired token as fully authorized to receive the complete set of identity claims regardless of the granted scopes during the initial authorization code exchange. The exploitation method involves an attacker initiating a standard authentication flow, acquiring an access token with minimal or zero privileges (e.g., a token restricted to a non-sensitive API scope), and then directly invoking the userinfo endpoint using that token. The vulnerable component is the token validation and scope enforcement middleware or controller logic residing within the OIDC provider's userinfo endpoint handler. Network exposure is external, as the userinfo endpoint is typically accessible over HTTPS to authenticated clients. Authentication requirements are technically met by providing a valid bearer token, but privilege requirements are improperly bypassed due to the absence of scope checks. The payload behavior involves a standard HTTP GET or POST request directed at the userinfo endpoint containing the improperly scoped token in the Authorization header. Post-exploitation impact encompasses the continuous harvesting of sensitive user claims, identity profiling, and potential escalation of attack vectors if the exposed claims contain security-sensitive metadata or internal identifiers."
}