CVE-2026-33322Critical▾ Midnight

MinIO has JWT Algorithm Confusion in OIDC Authentication

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score52/ 100 · Moderate

impact 52.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 19, 2026

Updated

Sep 10, 2026

CVSS

—

Vendor

minio

Product

github.com/minio/minio

CWE

—

Depth score

52 · Moderate

EPSS

0.41% · p35

Platforms

—

Source

OSV

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Sep 12.

0.4% → 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 177 days

Mar 19, 2026Published
Disclosed via OSV
Sep 10, 2026Record revised
Last analysed / modified upstream
Sep 12, 2026EPSS first tracked
0.4%

minio #osv #go

Affected

github.com/minio/minio <= 0.0.0-20260212201848-7aac2a2c5b7c

Full technical detail▾

Overview

Impact

What kind of vulnerability is it? Who is impacted?

A JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with any policy, including consoleAdmin.

An attacker with knowledge of the OIDC ClientSecret can:

Impersonate any user identity
Obtain S3 credentials with any IAM policy, including consoleAdmin
Access, modify, or delete any data in the MinIO deployment

The attack is deterministic (100% success rate, no race conditions).

Attack Prerequisites

The attacker must know the OIDC ClientSecret. While this is a shared credential (not a private key), it is more accessible than commonly assumed:

CVE-2023-28432 previously leaked environment variables including MINIO_IDENTITY_OPENID_CLIENT_SECRET
Client secrets are often present in frontend OAuth configurations, mobile app bundles, CI/CD pipelines, and shared configuration files
In many organizations, the client secret is accessible to operators and engineers who should not be able to forge arbitrary identities

Affected Versions

All MinIO releases from RELEASE.2022-11-08T05-27-07Z through the final release of the minio/minio open-source project.

Patches

Fixed in: MinIO AIStor RELEASE.2026-03-17T21-25-16Z

Downloads

Binary Downloads

Platform	Architecture	Download
Linux	amd64	minio
Linux	arm64	minio
macOS	arm64	minio
macOS	amd64	minio
Windows	amd64	minio.exe

FIPS Binaries

Platform	Architecture	Download
Linux	amd64	minio.fips
Linux	arm64	minio.fips

Package Downloads

Format	Architecture	Download
DEB	amd64	minio_20260317212516.0.0_amd64.deb
DEB	arm64	minio_20260317212516.0.0_arm64.deb
RPM	amd64	minio-20260317212516.0.0-1.x86_64.rpm
RPM	arm64	minio-20260317212516.0.0-1.aarch64.rpm

Container Images

# Standard
docker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z
podman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z

# FIPS
docker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips
podman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips

Homebrew (macOS)

brew install minio/aistor/minio

Workarounds

Users of the open-source minio/minio project should upgrade to MinIO AIStor RELEASE.2026-03-17T21-25-16Z or later.
As a workaround, ensure that the OIDC ClientSecret is treated as a highly sensitive credential and is not exposed to untrusted parties.

Affected packages

github.com/minio/minio <= 0.0.0-20260212201848-7aac2a2c5b7c

Remediation

Refer to the advisory for the patched release.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#go

← Back to feed