# OAuth2 2.x 업그레이드 후 ID 토큰만 포함된 응답으로 OIDC 로그인 실패
**URL:** https://meta.discourse.org/t/oidc-login-fails-with-id-token-only-responses-after-oauth2-2-x-upgrade/412518
**Category:** Bug
**Tags:** openid-connect
**Created:** [9월 15, 2026, 7:59오후 UTC](https://meta.discourse.org/t/oidc-login-fails-with-id-token-only-responses-after-oauth2-2-x-upgrade/412518 "2026-09-15T19:59:13Z")
**Posts on this page:** 1
**Showing post:** 2
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [9월 15, 2026, 9:21오후 UTC](https://meta.discourse.org/t/oidc-login-fails-with-id-token-only-responses-after-oauth2-2-x-upgrade/412518/2 "2026-09-15T21:21:15Z")
이 문제는 다음 커밋으로 수정되었어야 합니다:
>
>
> Some providers return a token response with no access token at all, or
> with an e…mpty \`access\_token\` alongside the \`id\_token\`. \`oauth2\` 2.x
> treats \`id\_token\` as one of the keys that can hold the token value, so
> \`AccessToken.from\_hash\` either takes the \`id\_token\` and removes it from
> the params, leaving \`access\_token\["id\_token"\]\` nil and the JWT decode
> failing, or it takes the empty \`access\_token\` and raises
> "OAuth2::AccessToken has no token".
>
> When userinfo is disabled the strategy reads everything it needs from
> the \`id\_token\`, so build the access token directly and keep the whole
> parsed response in the params.
>
> \- The spec for the userinfo-disabled path goes back to an
> \`id\_token\`-only token response, which is what a provider with no
> userinfo endpoint sends.
> \- A new case covers a response with a blank \`access\_token\`.
해당 커밋을 배포한 후에도 문제가 계속 발생한다면 알려주세요.
---
_[View the full topic](https://meta.discourse.org/t/oidc-login-fails-with-id-token-only-responses-after-oauth2-2-x-upgrade/412518)._