I have been made aware of an application, at a client, that claims to use OIDC to authenticate users. This is however done via a non-standard flow that I find hard to assess from a security standpoint.
It starts with a frontend SPA initiating an OAuth2 Implicit grant with the openid scope. Important to note is that this is not an OIDC Implicit grant as only an access_token is returned. The token is then used in communications to the backend API, which uses the token to request attributes from the userinfo endpoint. The user is considered authenticated as the user returned from userinfo.
My first assessment is that this should be fine, as long as the TLS certificate on the userinfo endpoint is validated. However, I am not comfortable stating this to the customer since the flow seems to lack some of the key parts of OIDC, and I have never seen this flow promoted anywhere by anyone.