CVE-2026-45156

@@ -17,6 +17,7 @@
 use OCA\UserOIDC\Db\UserMapper;
 use OCA\UserOIDC\Helper\HttpClientHelper;
 use OCA\UserOIDC\Service\ID4MeService;
+use OCA\UserOIDC\Vendor\Firebase\JWT\JWT;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Db\MultipleObjectsReturnedException;
 use OCP\AppFramework\Http;
@@ -249,7 +250,24 @@ public function code(string $state = '', string $code = '', string $scope = '')
 		$plainHeaders = json_decode(base64_decode($header), true);
 		$plainPayload = json_decode(base64_decode($payload), true);
 
-		/** TODO: VALIATE SIGNATURE! */
+		// validate the JWT signature
+		$idTokenRaw = $data['id_token'];
+		$jwkUri = $openIdConfig->getJwksUri();
+		JWT::$leeway = 60;
+		try {
+			$jwks = $this->id4MeService->obtainJWK($jwkUri, $data['id_token'], true);
+			$idTokenPayload = JWT::decode($idTokenRaw, $jwks);
+		} catch (\Exception|\Throwable $e) {
+			$this->logger->debug('Failed to decode the JWT token, retrying with fresh JWK');
+			try {
+				$jwks = $this->id4MeService->obtainJWK($jwkUri, $idTokenRaw, false);
+				$idTokenPayload = JWT::decode($idTokenRaw, $jwks);
+			} catch (\Exception|\Throwable $e) {
+				$this->logger->debug('Failed to decode the JWT token with fresh JWK');
+				$message = $this->l10n->t('Failed to authenticate');
+				return $this->build403TemplateResponse($message, Http::STATUS_FORBIDDEN, ['reason' => 'token signature check failed']);
+			}
+		}
 
 		// Check expiration
 		if ($plainPayload['exp'] < $this->timeFactory->getTime()) {

@@ -178,7 +178,7 @@ private function validateKeyStrength(array $key, string $alg): void {
 	 * @return array The modified JWKS
 	 * @throws \RuntimeException if no matching key is found or algorithm is unsupported
 	 */
-	private function fixJwksAlg(array $jwks, string $jwt): array {
+	public function fixJwksAlg(array $jwks, string $jwt): array {
 		$jwtParts = explode('.', $jwt, 3);
 		$header = json_decode(JWT::urlsafeB64Decode($jwtParts[0]), true);
 		$kid = $header['kid'] ?? null;

@@ -9,13 +9,25 @@
 namespace OCA\UserOIDC\Service;
 
 use OCA\UserOIDC\AppInfo\Application;
+use OCA\UserOIDC\Helper\HttpClientHelper;
+use OCA\UserOIDC\Vendor\Firebase\JWT\JWK;
 use OCP\IAppConfig;
+use OCP\ICache;
+use OCP\ICacheFactory;
+use Psr\Log\LoggerInterface;
 
 class ID4MeService {
 
+	private ICache $cache;
+
 	public function __construct(
 		private IAppConfig $appConfig,
+		private DiscoveryService $discoveryService,
+		private LoggerInterface $logger,
+		private HttpClientHelper $clientService,
+		ICacheFactory $cacheFactory,
 	) {
+		$this->cache = $cacheFactory->createDistributed('user_oidc');
 	}
 
 	public function setID4ME(bool $enabled): void {
@@ -25,4 +37,24 @@ public function setID4ME(bool $enabled): void {
 	public function getID4ME(): bool {
 		return $this->appConfig->getValueString(Application::APP_ID, 'id4me_enabled', '0', lazy: true) === '1';
 	}
+
+	public function obtainJWK(string $jwkUri, string $tokenToDecode, bool $useCache = true): array {
+		$cacheKey = 'jwks-' . $jwkUri;
+		$cachedJwks = $this->cache->get($cacheKey);
+		if ($cachedJwks !== null && $useCache) {
+			$rawJwks = json_decode($cachedJwks, true, flags: JSON_THROW_ON_ERROR);
+			$this->logger->debug('[ID4ME-obtainJWK] jwks cache content', ['jwks_cache' => $rawJwks]);
+		} else {
+			$responseBody = (string)$this->clientService->get($jwkUri);
+			$rawJwks = json_decode($responseBody, true, flags: JSON_THROW_ON_ERROR);
+			$this->logger->debug('[ID4ME-obtainJWK] getting fresh jwks', ['jwks' => $rawJwks]);
+			$this->cache->set($cacheKey, $responseBody, DiscoveryService::INVALIDATE_JWKS_CACHE_AFTER_SECONDS);
+		}
+
+		$fixedJwks = $this->discoveryService->fixJwksAlg($rawJwks, $tokenToDecode);
+		$this->logger->debug('[ID4ME-obtainJWK] fixed jwks', ['fixed_jwks' => $fixedJwks]);
+		$jwks = JWK::parseKeySet($fixedJwks, 'RS256');
+		$this->logger->debug('Parsed the jwks');
+		return $jwks;
+	}
 }