Vulnerable code sample

import hashlib
from base64 import urlsafe_b64encode

# A list of supported JWS algorithms, mimicking Authlib's internal list.
# The vulnerability lies in how algorithms *not* in this list are handled.
JWS_ALGORITHMS = [
    'HS256', 'HS384', 'HS512',
    'RS256', 'RS384', 'RS512',
    'ES256', 'ES384', 'ES512',
    'PS256', 'PS384', 'PS512',
]

def to_bytes(s, encoding='utf-8'):
    """Helper to ensure string is in bytes."""
    if isinstance(s, bytes):
        return s
    return str(s).encode(encoding)

class VulnerableOIDCValidator:
    """
    A minimal class to represent the vulnerable logic in Authlib versions
    prior to the fix for CVE-2024-28498. The CVE in the prompt has a typo.
    """

    def _verify_hash(self, alg: str, h: bytes, s: str) -> bool:
        """
        This is a replica of the vulnerable _verify_hash method from
        Authlib's oidc/core/claims.py before it was patched.

        The vulnerability is the "fail-open" behavior: if an unsupported
        algorithm is provided, the function silently returns True instead of
        raising an error or returning False.
        """
        # VULNERABLE LOGIC: If 'alg' is unknown, validation passes.
        if alg not in JWS_ALGORITHMS:
            # An attacker can use an algorithm like 'none' or any invented
            # string to bypass this check entirely.
            # The function should have raised an error or returned False.
            return True

        # This part of the code is correct but is bypassed by the flaw.
        digest_alg = getattr(hashlib, 'sha' + alg[2:])
        digest_size = digest_alg().digest_size
        left_most_size = digest_size // 2
        value = to_bytes(s)
        hashed_value = digest_alg(value).digest()
        # The provided hash `h` is compared with the computed hash.
        return h == urlsafe_b64encode(hashed_value[:left_most_size]).rstrip(b'=')

    def validate_id_token_hashes(self, id_token: dict, access_token: str):
        """
        Simulates the validation of at_hash (Access Token hash) from an ID Token.
        """
        id_token_header_alg = id_token.get('header', {}).get('alg')
        at_hash = id_token.get('at_hash')

        print(f"--- Validating with ID Token signed with alg='{id_token_header_alg}' ---")

        # Validate at_hash
        if at_hash:
            print(f"Validating at_hash: '{at_hash.decode()}'...")
            at_hash_valid = self._verify_hash(id_token_header_alg, at_hash, access_token)
            print(f"Result: {'PASSED' if at_hash_valid else 'FAILED'}")
            if not at_hash_valid:
                return False

        print("---------------------------------------------------\n")
        return True


# --- DEMONSTRATION OF THE VULNERABILITY ---

validator = VulnerableOIDCValidator()

# SCENARIO 1: A legitimate ID Token with a valid at_hash.
# The `alg` used for the ID Token signature is 'RS256'.
# The at_hash is correctly calculated for the given access token.
print("SCENARIO 1: Legitimate validation with a supported algorithm.")
legit_access_token = "YjJiMDg1ZTQ1Zjc2NTYyZGM3N2YxZTQ0YTg4MGE3YmU"
# Correct at_hash for the token above, using RS256's SHA-256
#
# How to calculate:
# 1. SHA-256 hash of the access token:
#    hashlib.sha256(b"YjJiMDg1ZTQ1Zjc2NTYyZGM3N2YxZTQ0YTg4MGE3YmU").digest()
# 2. Take the left-most 128 bits (16 bytes).
# 3. Base64url encode the result.
#
legit_at_hash = b'77nfz2-77F1_x3b3aSCp_g'
legit_id_token = {
    'header': {'alg': 'RS256'},
    'at_hash': legit_at_hash,
}
validator.validate_id_token_hashes(legit_id_token, legit_access_token)


# SCENARIO 2: An attacker crafts a forged ID Token.
# They provide a completely invalid `at_hash`.
# To bypass validation, they set the ID Token's signing algorithm ('alg')
# to an unsupported value like 'none' or any other unknown string.
print("SCENARIO 2: Attack using an unsupported algorithm to bypass validation.")
forged_access_token = "this_is_a_stolen_or_unrelated_access_token"
forged_id_token = {
    # The attacker sets the 'alg' to something the library doesn't support.
    'header': {'alg': 'none'},
    # The hash is completely fake and does not match the token.
    'at_hash': b'attacker_provided_junk_hash',
}

# Due to the vulnerability, the _verify_hash function will return True
# for the at_hash check because 'none' is not in JWS_ALGORITHMS.
# This allows the forged ID Token to be accepted as valid.
validation_result = validator.validate_id_token_hashes(
    forged_id_token,
    forged_access_token
)

if validation_result:
    print("VULNERABILITY CONFIRMED: The forged ID Token was accepted as valid.")
else:
    print("Vulnerability not present. The forged ID Token was rejected.")