CVE-2026-55689Medium· 6.8▾ SunlitOpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.4%
OpenFGA's OIDC authenticator skipped JWT audience (aud) validation when no audience was configured.
In deployments where one identity provider issues tokens for multiple services,
a token minted for an unrelated service could authenticate to OpenFGA.
This applies if the following preconditions are met:
authn.method set to oidc.authn.oidc.issuer but did not set
authn.oidc.audience (--authn-oidc-audience / OPENFGA_AUTHN_OIDC_AUDIENCE).Upgrade to OpenFGA 1.18.0 or greater. OpenFGA now refuses to start in oidc
mode unless both authn.oidc.issuer and authn.oidc.audience are set, and the
aud claim is always validated.
OpenFGA would like to thank https://github.com/0xVijay for the report.
github.com/openfga/openfga <= 1.17.1Upgrade to a patched release:
github.com/openfga/openfga 1.18.0Connected by shared product, vendor, weakness, or advisory.
CVE-2024-56323MediumOpenFGA Authorization Bypass
CVE-2023-43645Medium· 5.9OpenFGA Vulnerable to DoS from circular relationship definitions
CVE-2025-64751MediumOpenFGA Improper Policy Enforcement
CVE-2026-41131Medium· 5.0OpenFGA has Improper Policy Enforcement
CVE-2026-48096Medium· 5.0OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poiso…
CVE-2026-55170LowOpenFGA Improper Policy Enforcement