Junglewise Threat Intelligence

CVE-2026-55689: OpenFGA improper authentication via JWT audience skip in OIDC authenticator

CVE-2026-55689 · Severity: medium · CVSS 6.8 · Published 2026-07-09

Executive brief

OpenFGA is an authorization engine used by developers to manage user permissions and access control. A security flaw in its authentication system allowed users to log in using security tokens intended for completely different services, provided they were issued by the same identity provider. This could allow unauthorized individuals to bypass security checks and gain access to the system.

Technical details

An improper authentication vulnerability exists in OpenFGA's OIDC implementation prior to version 1.18.0. When 'authn.method' is set to 'oidc' and an issuer is configured without a corresponding audience ('authn.oidc.audience'), the system silently skips validation of the JWT 'aud' claim. This allows an attacker with a validly-signed token from the same trusted identity provider, even if minted for an unrelated application, to successfully authenticate to OpenFGA. The fix in version 1.18.0 enforces that both issuer and audience must be configured for the service to start, ensuring the 'aud' claim is always validated.

Affected products

  • OpenFGA OpenFGA < 1.18.0
  • OpenFGA OpenFGA Helm Chart <= 0.3.8

Timeline

  • 2026-06-16: patched: Fix committed to repository
  • 2026-06-17: advisory: Version 1.18.0 released
  • 2026-07-09: disclosed: CVE published to NVD

References

Related threats