CVE-2026-55689
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In OpenFGA prior to version 1.18.0, the OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set. This allows a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA.
Risk Assessment
The organization is at risk of unauthorized access to the OpenFGA system, as an attacker could use a JWT token intended for another service, potentially leading to data integrity and confidentiality breaches.
Recommendation
Immediately update OpenFGA to version 1.18.0 or later, which includes a fix that enforces JWT audience validation.
Other vulnerabilities in OpenFGA
See all- CVE-2026-55170Medium
In OpenFGA prior to version 1.18.0, when MySQL is used as the datastore, the tuple, changelog, and authorization_model identifier columns compare case-distinct values (e.g., user:Alice and user:alice) as equivalent, causing two distinct check requests to return the same response.
- CVE-2026-48096Medium
OpenFGA, an authorization engine, prior to version 1.16.0, had an issue with iterator caching where two distinct check requests could produce the same cache key. This led to the reuse of an earlier cached result for a subsequent request.
- CVE-2026-40293Medium
In OpenFGA versions 0.1.4 through 1.13.1, when configured with preshared-key authentication and the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. This endpoint is enabled by default and does not require authentication, potentially leading to sensitive data exposure.
- CVE-2026-34972Medium
OpenFGA, a high-performance authorization/permission engine, has a vulnerability in BatchCheck calls where multiple checks for the same object, relation, and user combination can result in improper policy enforcement. This affects versions 1.8.0 to 1.13.1.
- CVE-2023-35933Medium
OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected if they are using these versions and executing these calls on vulnerable models.
Original NVD description (English source)
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.