{"id":"CVE-2026-33322","aliases":["GHSA-5cx5-wh4m-82fh","BIT-minio-2026-33322","GO-2026-4779"],"title":"MinIO has JWT Algorithm Confusion in OIDC Authentication","summary":"MinIO has JWT Algorithm Confusion in OIDC Authentication","severity":"critical","vendor":"minio","product":"github.com/minio/minio","ecosystem":"go","affected":["github.com/minio/minio <= 0.0.0-20260212201848-7aac2a2c5b7c"],"published":"2026-03-19","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:37.383799739Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-5cx5-wh4m-82fh","references":[{"url":"https://github.com/minio/minio/security/advisories/GHSA-5cx5-wh4m-82fh"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33322"},{"url":"https://github.com/minio/minio"}],"tags":["osv","go"],"epss":0.0041,"epssPercentile":0.34852,"ingestedAt":"2026-09-12T03:13:01.755Z","slug":"CVE-2026-33322","body":"## Overview\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC `ClientSecret` to forge arbitrary identity tokens and obtain S3 credentials with any policy, including `consoleAdmin`.\n\nAn attacker with knowledge of the OIDC `ClientSecret` can:\n\n- Impersonate any user identity\n- Obtain S3 credentials with any IAM policy, including `consoleAdmin`\n- Access, modify, or delete any data in the MinIO deployment\n\nThe attack is deterministic (100% success rate, no race conditions).\n\n#### Attack Prerequisites\n\nThe attacker must know the OIDC `ClientSecret`. While this is a shared credential (not a private key), it is more accessible than commonly assumed:\n\n- CVE-2023-28432 previously leaked environment variables including `MINIO_IDENTITY_OPENID_CLIENT_SECRET`\n- Client secrets are often present in frontend OAuth configurations, mobile app bundles, CI/CD pipelines, and shared configuration files\n- In many organizations, the client secret is accessible to operators and engineers who should not be able to forge arbitrary identities\n\n\n#### Affected Versions\n\nAll MinIO releases from `RELEASE.2022-11-08T05-27-07Z` through the final release of the `minio/minio` open-source project.\n\n### Patches\n\n**Fixed in:** MinIO AIStor `RELEASE.2026-03-17T21-25-16Z`\n\n## Downloads\n\n### Binary Downloads\n\n| Platform | Architecture | Download                                                                    |\n| -------- | ------------ | --------------------------------------------------------------------------- |\n| Linux    | amd64        | [minio](https://dl.min.io/aistor/minio/release/linux-amd64/minio)           |\n| Linux    | arm64        | [minio](https://dl.min.io/aistor/minio/release/linux-arm64/minio)           |\n| macOS    | arm64        | [minio](https://dl.min.io/aistor/minio/release/darwin-arm64/minio)          |\n| macOS    | amd64        | [minio](https://dl.min.io/aistor/minio/release/darwin-amd64/minio)          |\n| Windows  | amd64        | [minio.exe](https://dl.min.io/aistor/minio/release/windows-amd64/minio.exe) |\n\n### FIPS Binaries\n\n| Platform | Architecture | Download                                                                    |\n| -------- | ------------ | --------------------------------------------------------------------------- |\n| Linux    | amd64        | [minio.fips](https://dl.min.io/aistor/minio/release/linux-amd64/minio.fips) |\n| Linux    | arm64        | [minio.fips](https://dl.min.io/aistor/minio/release/linux-arm64/minio.fips) |\n\n### Package Downloads\n\n| Format | Architecture | Download                                                                                                                            |\n| ------ | ------------ | ----------------------------------------------------------------------------------------------------------------------------------- |\n| DEB    | amd64        | [minio_20260317212516.0.0_amd64.deb](https://dl.min.io/aistor/minio/release/linux-amd64/minio_20260317212516.0.0_amd64.deb)         |\n| DEB    | arm64        | [minio_20260317212516.0.0_arm64.deb](https://dl.min.io/aistor/minio/release/linux-arm64/minio_20260317212516.0.0_arm64.deb)         |\n| RPM    | amd64        | [minio-20260317212516.0.0-1.x86_64.rpm](https://dl.min.io/aistor/minio/release/linux-amd64/minio-20260317212516.0.0-1.x86_64.rpm)   |\n| RPM    | arm64        | [minio-20260317212516.0.0-1.aarch64.rpm](https://dl.min.io/aistor/minio/release/linux-arm64/minio-20260317212516.0.0-1.aarch64.rpm) |\n\n### Container Images\n\n```bash\n# Standard\ndocker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z\npodman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z\n\n# FIPS\ndocker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips\npodman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips\n```\n\n### Homebrew (macOS)\n\n```bash\nbrew install minio/aistor/minio\n```\n\n### Workarounds\n\n- [Users of the open-source `minio/minio` project should upgrade to MinIO AIStor `RELEASE.2026-03-17T21-25-16Z` or later.](https://docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/community-edition/)\n- As a workaround, ensure that the OIDC `ClientSecret` is treated as a highly sensitive credential and is not exposed to untrusted parties.\n\n## Affected packages\n\n- `github.com/minio/minio <= 0.0.0-20260212201848-7aac2a2c5b7c`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":52.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}