What are the disadvantages and risks of OpenID Connect?

Limited anonymity (the app sees the provider account's real name), phishing (fake login pages still work), dependency (one compromised login affects every connected application) and developer reluctance (complex protocols that are hard to implement correctly).

• Conditional anonymity: after logging in through a well-known OP, the user is signed in with that account's identity. If the profile uses the real name, the application sees it. The OP also learns which applications the user signs in to and when.
• Phishing: users can still land on a fake login page that imitates the OP and type in their credentials. Because one OP account opens many applications, it is an especially valuable phishing target.
• Dependency (the flip side of usability): if the single login is compromised, every application connected to it is affected; and if the OP is unavailable or blocks the account, the user is locked out of all of them.
• Developer reluctance: OIDC's protocols are relatively complex, and getting every validation step right is hard; mistakes (skipped aud or nonce checks, loose redirect URIs) are common.

Mitigations follow the same lines: strong, phishing-resistant authentication at the OP (passkeys, second factors), using established libraries instead of hand-written protocol code, and offering more than one login option.

Go deeper:

• Phishing (Wikipedia) — the techniques used to imitate login pages.
• RFC 9700: Best Current Practice for OAuth 2.0 Security — the attack catalogue behind the "hard to implement correctly" point.