Is CVE-2026-55689 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55689 being exploited in the wild.

How severe is CVE-2026-55689?

Medium severity, with a CVSS score of 6.8, published 9 July 2026.

Which products and versions are affected?

github.com/openfga/openfga (Go) <= 1.17.1, SEMVER:introduced=0,fixed=1.18.0; OpenFGA < 1.18.0, <= 1.17.1; OpenFGA Helm Chart <= 0.3.8.

Is there a fix for CVE-2026-55689?

Yes. github.com/openfga/openfga (Go): upgrade to 1.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55689 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55689?

Check whether you run github.com/openfga/openfga (Go), OpenFGA or OpenFGA Helm Chart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55689: OpenFGA improper authentication via JWT audience skip in OIDC authenticator

Q: Is there a fix for CVE-2026-55689?

Yes. github.com/openfga/openfga (Go): upgrade to 1.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55689 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-55689?

Check whether you run github.com/openfga/openfga (Go), OpenFGA or OpenFGA Helm Chart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55689 · Severity: medium · CVSS 6.8 · Published 2026-07-09

OpenFGA is an authorization engine used by developers to manage user permissions and access control. A security flaw in its authentication system allowed users to log in using security tokens intended for completely different services, provided they were issued by the same identity provider. This could allow unauthorized individuals to bypass security checks and gain access to the system.

Technologies: github.com/openfga/openfga (Go), OpenFGA. Vendors: Go, OpenFGA.

Quick answers

Is CVE-2026-55689 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55689 being exploited in the wild.
How severe is CVE-2026-55689?: Medium severity, with a CVSS score of 6.8, published 9 July 2026.
Which products and versions are affected?: github.com/openfga/openfga (Go) <= 1.17.1, SEMVER:introduced=0,fixed=1.18.0; OpenFGA < 1.18.0, <= 1.17.1; OpenFGA Helm Chart <= 0.3.8.
Is there a fix for CVE-2026-55689?: Yes. github.com/openfga/openfga (Go): upgrade to 1.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55689 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55689?: Check whether you run github.com/openfga/openfga (Go), OpenFGA or OpenFGA Helm Chart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/openfga/openfga (Go): upgrade to 1.18.0 or later
```
go get github.com/openfga/openfga@v1.18.0
```

Technical details

An improper authentication vulnerability exists in OpenFGA's OIDC implementation prior to version 1.18.0. When 'authn.method' is set to 'oidc' and an issuer is configured without a corresponding audience ('authn.oidc.audience'), the system silently skips validation of the JWT 'aud' claim. This allows an attacker with a validly-signed token from the same trusted identity provider, even if minted for an unrelated application, to successfully authenticate to OpenFGA. The fix in version 1.18.0 enforces that both issuer and audience must be configured for the service to start, ensuring the 'aud' claim is always validated.

Affected products

OpenFGA OpenFGA < 1.18.0
OpenFGA OpenFGA Helm Chart <= 0.3.8

Identifiers

CVE-2026-55689
GHSA-hcxc-wf8j-23hv
GO-2026-5423

Timeline

2026-06-16: patched: Fix committed to repository
2026-06-17: advisory: Version 1.18.0 released
2026-07-09: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.