Issues

• [Security] The OP is a broker: shared-consent requirements for per-RP consent (security-topics-update §2.4)

  openid/claims-aggregation#38 · Filter by author sakimura opened on Jul 12, 2026

• [Security] Setup Phase session fixation binds the victim's CP claims to the attacker's OP account (security-topics-update §2.3)

  openid/claims-aggregation#37 · Filter by author sakimura opened on Jul 12, 2026

• [Security] Per-CP connection context binding for the multi-CP OP (COAT, security-topics-update §2.2)

  openid/claims-aggregation#36 · Filter by author sakimura opened on Jul 12, 2026

• [Security] Audience injection on signature-based OP client authentication at CPs (security-topics-update §2.1)

  openid/claims-aggregation#35 · Filter by author sakimura opened on Jul 12, 2026

• [Editorial] Registration Phase description of userinfo_signed_response_alg inverts the direction

  openid/claims-aggregation#33 · Filter by author sakimura opened on Jul 12, 2026

• [Editorial] Cite "OpenID Connect core" properly

  openid/claims-aggregation#32 · Filter by author sakimura opened on Jul 12, 2026

• [Editorial] Setup Phase CP requirements buried inside the OP action list

  openid/claims-aggregation#31 · Filter by author sakimura opened on Jul 12, 2026

• [Editorial] Duplicate actor descriptions; unlabeled OP–CP edge in figure

  openid/claims-aggregation#30 · Filter by author sakimura opened on Jul 12, 2026

• [Editorial] Typos and grammar fixes

  openid/claims-aggregation#29 · Filter by author sakimura opened on Jul 12, 2026
  1

• [Editorial] Inconsistent terminology: "Aggregate Claim" / "Aggregated Claims" / "Claim Set"

  openid/claims-aggregation#28 · Filter by author sakimura opened on Jul 12, 2026

• [Editorial] Abstract/Scope mismatch; "verified claims" undefined

  openid/claims-aggregation#27 · Filter by author sakimura opened on Jul 12, 2026

• [Editorial] Changelog claims "Stated trust model" but no trust model section exists

  openid/claims-aggregation#26 · Filter by author sakimura opened on Jul 12, 2026

• [Interop] Delivery location and error semantics unspecified

  openid/claims-aggregation#25 · Filter by author sakimura opened on Jul 12, 2026

• [Interop] policy_url is not the registered parameter name (should be policy_uri)

  openid/claims-aggregation#24 · Filter by author sakimura opened on Jul 12, 2026

• [Interop] claim_types_supported requirement targets the wrong (or ambiguous) entity

  openid/claims-aggregation#23 · Filter by author sakimura opened on Jul 12, 2026

• [Interop] Reference rot: pre-RFC draft URLs for JWT/JWS/JWE/JWA; RFC 7636 missing; BCP 14 mismatch

  openid/claims-aggregation#22 · Filter by author sakimura opened on Jul 12, 2026

• [Interop] Downscoping depends on refresh tokens that are optional; offline_access never mentioned

  openid/claims-aggregation#21 · Filter by author sakimura opened on Jul 12, 2026

• [Interop] userinfo_signed_response_alg as CP metadata collides with the registration parameter and duplicates userinfo_signing_alg_values_supported

  openid/claims-aggregation#20 · Filter by author sakimura opened on Jul 12, 2026

• [Interop] Key discovery for RP verification of CP signatures is unspecified

  openid/claims-aggregation#19 · Filter by author sakimura opened on Jul 12, 2026

• [Interop] RP request "extension parameters defined in this document" are not defined

  openid/claims-aggregation#18 · Filter by author sakimura opened on Jul 12, 2026

• [Interop] RP aud verification cannot succeed under dynamic registration

  openid/claims-aggregation#17 · Filter by author sakimura opened on Jul 12, 2026

• [Privacy] Prohibiting userinfo_encrypted_response_alg bans a confidentiality control

  openid/claims-aggregation#16 · Filter by author sakimura opened on Jul 12, 2026

• [Privacy] Open-ended consent at Setup Phase relies on OP honesty

  openid/claims-aggregation#15 · Filter by author sakimura opened on Jul 12, 2026

• [Privacy] Over-collection and unbounded retention; no deletion or revocation requirements

  openid/claims-aggregation#14 · Filter by author sakimura opened on Jul 12, 2026

• [Privacy] Correlation analysis incomplete: RP–CP collusion, common CP sub across RPs, non-repudiation

  openid/claims-aggregation#13 · Filter by author sakimura opened on Jul 12, 2026