CVE-2026-55689 | THREATINT

Description

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.

PUBLISHED Reserved 2026-06-17 | Published 2026-07-09 | Updated 2026-07-10 | Assigner GitHub_M

MEDIUM: 6.8CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-287: Improper Authentication

Product status

< 1.18.0

affected

References

github.com/...penfga/security/advisories/GHSA-hcxc-wf8j-23hv

github.com/...ommit/44596773b2e62738720ef215bf7fa04352954271

github.com/openfga/helm-ch

github.com/openfga/helm-charts/releases/tag/openfga-0.3.9

github.com/openfga/openfga/releases/tag/v1.18.0

cve.org (CVE-2026-55689)

nvd.nist.gov (CVE-2026-55689)

Download JSON