Beveiligingsadvies

CVE-2026-55689

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-09 21:06:22

Laatst bijgewerkt 2026-07-10 13:45:39

Toegewezen door GitHub_M

CVSS-score 6.8

Status PUBLISHED

Beschrijving

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.

← Alle CVE's bekijken Bekijk op cve.org ↗