Skip to content
Log inStart free trial

GHSA-hcxc-wf8j-23hv CVE-2026-55689 GO-2026-5423

OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset

High Go
Severity
6.8 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.41%
Chance of exploitation in the next 30 days. Higher than 34.95% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-287 Improper Authentication
Fix
1.18.0
Upgrade github.com/openfga/openfga to this version or later

Description

Description

OpenFGA's OIDC authenticator skipped JWT audience (aud) validation when no audience was configured. In deployments where one identity provider issues tokens for multiple services, a token minted for an unrelated service could authenticate to OpenFGA.

Preconditions

This applies if the following preconditions are met:

  1. You run OpenFGA with authn.method set to oidc.
  2. You configured authn.oidc.issuer but did not set authn.oidc.audience (--authn-oidc-audience / OPENFGA_AUTHN_OIDC_AUDIENCE).

Fix

Upgrade to OpenFGA 1.18.0 or greater. OpenFGA now refuses to start in oidc mode unless both authn.oidc.issuer and authn.oidc.audience are set, and the aud claim is always validated.

Acknowledgements

OpenFGA would like to thank https://github.com/0xVijay for the report.

Affected versions

Go

PackageVulnerableFixed in
github.com/openfga/openfga
< 1.18.0
1.18.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/openfga/openfga Go → 1.18.0

go
go get github.com/openfga/openfga@v1.18.0 && go mod tidy

Severity breakdown

CVSS 3.1 6.8

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack vector
Network
Attack complexity
High
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Weakness

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How to prevent it
  • Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-g3pg-frfm-pr2m
OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user
Medium Also affects github.com/openfga/openfga
GHSA-cf98-j28v-49v6
OpenFGA Improper Policy Enforcement
Medium Also affects github.com/openfga/openfga
GHSA-8396-jffm-qx4w
OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning
Medium Also affects github.com/openfga/openfga
GHSA-57j5-qwp2-vqp6
OpenFGA has Improper Policy Enforcement
Medium Also affects github.com/openfga/openfga
GHSA-68m9-983m-f3v5
OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response
Medium Also affects github.com/openfga/openfga
GHSA-jwvj-g8pc-cx45
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision
High Also affects github.com/openfga/openfga
GHSA-h6c8-cww8-35hf
OpenFGA has an Authorization Bypass through cached keys
Critical Also affects github.com/openfga/openfga
GHSA-jq9f-gm9w-rwm9
OpenFGA Improper Policy Enforcement
High Also affects github.com/openfga/openfga
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor