Vulnerability warning some OpenID 2.0 implementations contain security risks

Vulnerability warning released by the OpenID official organization: Some OpenID 2.0 certification implementations do not comply with OpenID Authentication 2.0 specifications, leading to security vulnerabilities.

Vulnerability nature:

In section 11.4.2.1 of the OpenID 2.0 specification, it is described: "The OP must be signed and not verified on the private association ." However, some OpenID implementations do not differentiate private associations and shared associations, and directly perform signature verification on the shared associations.

Vulnerability impact:

By carefully crafted signatures built on shared associations, any dependent Party (RP) can be associated with a vulnerable OP through sharing. This also allows attackers to easily log on to the RP.

How to check whether this vulnerability exists:

You can use the following website for verification:
Http://test-id.org/OP/CheckAuthSharedSecret.aspx

I hope this notification will attract the attention of the community.

Don Thibeau
Executive Director of OpenID Foundation