pypi package report

Is oic safe?

1 known vulnerability, worst severity HIGH.

// reach

20 direct dependencies

10 carry known advisories, worst HIGH

4 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

No published models are known to use this package.

cvss

6.8

medium

CVSS v3.1 base score out of 10; GitHub rates it HIGH

epss

0.83%

medium

chance of exploitation in 30 days, 58th percentile of all CVEs

xyz score

4.0

medium

CyberXYZ composite out of 10

fig. 01 — GHSA-4fjv-pmhg-3rfg, the advisory selected below

// 1 advisories

GHSA-4fjv-pmhg-3rfg

HIGHGitHub ratingCVE-2020-26244

// impact

Client implementations using this library

// issues

The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg.
JWA none algorithm was allowed in all flows.
oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator.
iat claim was not checked for sanity (i.e. it could be in the future)

// patches

IdToken signature is now always checked.
JWA none algorithm is now allowed only if using the response_type code
IdToken verification is now done automatically.
iat claim is now checked for sanity.

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack vector: Network
Attack complexity: High
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Checked 2026-11-06 at 22:26 UTC. The most recent advisory here was published 2020-12-04. Updated continuously from NVD, GHSA, OSV and CNA feeds.