{"id":"CVE-2026-55689","title":"OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset","summary":"OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset","severity":"medium","cvss":6.8,"cwe":["CWE-287"],"vendor":"openfga","product":"github.com/openfga/openfga","affected":["github.com/openfga/openfga <= 1.17.1"],"patched":["github.com/openfga/openfga 1.18.0"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-hcxc-wf8j-23hv","references":[{"url":"https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv"},{"url":"https://github.com/advisories/GHSA-hcxc-wf8j-23hv"}],"tags":["ghsa","go"],"ingestedAt":"2026-06-22T15:59:08.187Z","ecosystem":"go","epss":0.00407,"epssPercentile":0.34705,"slug":"CVE-2026-55689","body":"## Overview\n\n## Description\n\nOpenFGA's OIDC authenticator skipped JWT audience (`aud`) validation when no audience was configured.\nIn deployments where one identity provider issues tokens for multiple services,\na token minted for an unrelated service could authenticate to OpenFGA.\n\n## Preconditions\n\nThis applies if the following preconditions are met:\n\n1. You run OpenFGA with `authn.method` set to `oidc`.\n2. You configured `authn.oidc.issuer` but did **not** set\n   `authn.oidc.audience` (`--authn-oidc-audience` / `OPENFGA_AUTHN_OIDC_AUDIENCE`).\n\n## Fix\n\nUpgrade to OpenFGA 1.18.0 or greater. OpenFGA now refuses to start in `oidc`\nmode unless both `authn.oidc.issuer` and `authn.oidc.audience` are set, and the\n`aud` claim is always validated.\n\n## Acknowledgements\n\nOpenFGA would like to thank https://github.com/0xVijay for the report.\n\n## Affected packages\n\n- `github.com/openfga/openfga <= 1.17.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/openfga/openfga 1.18.0`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}