---
id: CVE-2026-55689
title: 'OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset'
summary: 'OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset'
severity: medium
cvss: 6.8
cwe:
  - CWE-287
vendor: openfga
product: github.com/openfga/openfga
affected:
  - github.com/openfga/openfga <= 1.17.1
patched:
  - github.com/openfga/openfga 1.18.0
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-hcxc-wf8j-23hv'
references:
  - url: 'https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv'
  - url: 'https://github.com/advisories/GHSA-hcxc-wf8j-23hv'
tags:
  - ghsa
  - go
ingestedAt: '2026-06-22T15:59:08.187Z'
ecosystem: go
epss: 0.00407
epssPercentile: 0.32117
---

## Overview

## Description

OpenFGA's OIDC authenticator skipped JWT audience (`aud`) validation when no audience was configured.
In deployments where one identity provider issues tokens for multiple services,
a token minted for an unrelated service could authenticate to OpenFGA.

## Preconditions

This applies if the following preconditions are met:

1. You run OpenFGA with `authn.method` set to `oidc`.
2. You configured `authn.oidc.issuer` but did **not** set
   `authn.oidc.audience` (`--authn-oidc-audience` / `OPENFGA_AUTHN_OIDC_AUDIENCE`).

## Fix

Upgrade to OpenFGA 1.18.0 or greater. OpenFGA now refuses to start in `oidc`
mode unless both `authn.oidc.issuer` and `authn.oidc.audience` are set, and the
`aud` claim is always validated.

## Acknowledgements

OpenFGA would like to thank https://github.com/0xVijay for the report.

## Affected packages

- `github.com/openfga/openfga <= 1.17.1`

## Remediation

Upgrade to a patched release:

- `github.com/openfga/openfga 1.18.0`