Security Advisory

CVE-2026-55689

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-09 21:06:22

Last updated 2026-07-10 13:45:39

Assigner GitHub_M

CVSS score 6.8

State PUBLISHED

Description

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.

← Browse all CVEs View on cve.org ↗