OpenFGA vulnerabilities

In OpenFGA prior to version 1.18.0, the OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set. This allows a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA.

In OpenFGA prior to version 1.18.0, when MySQL is used as the datastore, the tuple, changelog, and authorization_model identifier columns compare case-distinct values (e.g., user:Alice and user:alice) as equivalent, causing two distinct check requests to return the same response.

OpenFGA, an authorization engine, prior to version 1.16.0, had an issue with iterator caching where two distinct check requests could produce the same cache key. This led to the reuse of an earlier cached result for a subsequent request.

In OpenFGA versions 0.1.4 through 1.13.1, when configured with preshared-key authentication and the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. This endpoint is enabled by default and does not require authentication, potentially leading to sensitive data exposure.

OpenFGA, a high-performance authorization/permission engine, has a vulnerability in BatchCheck calls where multiple checks for the same object, relation, and user combination can result in improper policy enforcement. This affects versions 1.8.0 to 1.13.1.

OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected if they are using these versions and executing these calls on vulnerable models.