# CVE-2026-40946: Oxia has an OIDC token audience validation bypass via SkipClientIDCheck

Source: https://junglewise.ai/threats/cve-2026-40946-oxia-has-an-oidc-token-audience-validation-bypass-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40946 · Severity: critical · CVSS 4 · Published 2026-04-14

### Summary
The OIDC authentication provider unconditionally sets `SkipClientIDCheck: true` in the `go-oidc` verifier configuration, disabling the standard audience (`aud`) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia.

### Impact
In deployments using OIDC authentication, an attacker possessing a valid JWT token issued by the same identity provider but intended for a different service (different `client_id`/`aud`) can authenticate to Oxia. This bypasses the intended audience isolation of OAuth2/OIDC.

All versions using OIDC authentication are affected.

### Details
In `oxiad/common/rpc/auth/oidc.go`, both `createStaticKeyVerifier()` and `createRemoteVerifier()` set `SkipClientIDCheck: true`. While a custom audience check exists in `Authenticate()`, the library-level check — which validates the `aud` claim against the expected `client_id` — is completely bypassed.

### Patches
Fixed by removing `SkipClientIDCheck: true` and setting the `ClientID` field from the configured `AllowedAudiences`.

### Workarounds
Ensure network-level isolation so that only trusted services can reach the Oxia gRPC endpoints.

Technologies: [github.com/oxia-db/oxia (Go)](https://junglewise.ai/threats/technologies/github-com-oxia-db-oxia). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-40946 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40946 being exploited in the wild.

**How severe is CVE-2026-40946?** Critical severity, with a CVSS score of 4, published 14 April 2026.

**Which products and versions are affected?** github.com/oxia-db/oxia (Go) <= 0.16.1, SEMVER:introduced=0,fixed=0.16.2.

**Is there a fix for CVE-2026-40946?** Yes. github.com/oxia-db/oxia (Go): upgrade to 0.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-40946?** Check whether you run github.com/oxia-db/oxia (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/oxia-db/oxia (Go): upgrade to 0.16.2 or later

  ```sh
  go get github.com/oxia-db/oxia@v0.16.2
  ```


## Affected products

- github.com/oxia-db/oxia (Go) <= 0.16.1, SEMVER:introduced=0,fixed=0.16.2

## Identifiers

- CVE-2026-40946
- GHSA-fhvp-9hcj-6m33
- GO-2026-5364

## References

- [https://github.com/oxia-db/oxia/security/advisories/GHSA-fhvp-9hcj-6m33](https://github.com/oxia-db/oxia/security/advisories/GHSA-fhvp-9hcj-6m33)
- [https://api.github.com/repos/oxia-db/oxia/security-advisories/GHSA-fhvp-9hcj-6m33](https://api.github.com/repos/oxia-db/oxia/security-advisories/GHSA-fhvp-9hcj-6m33)

## Related threats

- [Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles](https://junglewise.ai/threats/cve-2026-40944-oxia-s-tls-ca-certificate-chain-validation-fails-with-multi)
- [Oxia affected by server crash via race condition in session heartbeat handling](https://junglewise.ai/threats/cve-2026-40943-oxia-affected-by-server-crash-via-race-condition-in-session)
- [Oxia exposes bearer token in debug log messages on authentication failure](https://junglewise.ai/threats/cve-2026-40945-oxia-exposes-bearer-token-in-debug-log-messages-on-authentication)