# CVE-2026-55689: OpenFGA improper authentication via JWT audience skip in OIDC authenticator

Source: https://junglewise.ai/threats/cve-2026-55689-openfga-improper-authentication-via-jwt-audience-skip-in-oidc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-55689 · Severity: medium · CVSS 6.8 · Published 2026-07-09

OpenFGA is an authorization engine used by developers to manage user permissions and access control. A security flaw in its authentication system allowed users to log in using security tokens intended for completely different services, provided they were issued by the same identity provider. This could allow unauthorized individuals to bypass security checks and gain access to the system.

Technologies: [github.com/openfga/openfga (Go)](https://junglewise.ai/threats/technologies/github-com-openfga-openfga), [OpenFGA](https://junglewise.ai/threats/technologies/openfga). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OpenFGA](https://junglewise.ai/threats/vendors/openfga).

## Quick answers

**Is CVE-2026-55689 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55689 being exploited in the wild.

**How severe is CVE-2026-55689?** Medium severity, with a CVSS score of 6.8, published 9 July 2026.

**Which products and versions are affected?** github.com/openfga/openfga (Go) <= 1.17.1, SEMVER:introduced=0,fixed=1.18.0; OpenFGA < 1.18.0, <= 1.17.1; OpenFGA Helm Chart <= 0.3.8.

**Is there a fix for CVE-2026-55689?** Yes. github.com/openfga/openfga (Go): upgrade to 1.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55689 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55689?** Check whether you run github.com/openfga/openfga (Go), OpenFGA or OpenFGA Helm Chart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/openfga/openfga (Go): upgrade to 1.18.0 or later

  ```sh
  go get github.com/openfga/openfga@v1.18.0
  ```


## Technical details

An improper authentication vulnerability exists in OpenFGA's OIDC implementation prior to version 1.18.0. When 'authn.method' is set to 'oidc' and an issuer is configured without a corresponding audience ('authn.oidc.audience'), the system silently skips validation of the JWT 'aud' claim. This allows an attacker with a validly-signed token from the same trusted identity provider, even if minted for an unrelated application, to successfully authenticate to OpenFGA. The fix in version 1.18.0 enforces that both issuer and audience must be configured for the service to start, ensuring the 'aud' claim is always validated.

## Affected products

- OpenFGA OpenFGA < 1.18.0
- OpenFGA OpenFGA Helm Chart <= 0.3.8

## Identifiers

- CVE-2026-55689
- GHSA-hcxc-wf8j-23hv
- GO-2026-5423

## Timeline

- 2026-06-16: patched: Fix committed to repository
- 2026-06-17: advisory: Version 1.18.0 released
- 2026-07-09: disclosed: CVE published to NVD

## References

- [https://github.com/openfga/helm-ch](https://github.com/openfga/helm-ch)
- [https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9](https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9)
- [https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271](https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271)
- [https://github.com/openfga/openfga/releases/tag/v1.18.0](https://github.com/openfga/openfga/releases/tag/v1.18.0)
- [https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv](https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv)

## Related threats

- [OpenFGA ListUsers incorrect authorization in intersection exclusions](https://junglewise.ai/threats/cve-2026-61709-openfga-listusers-incorrect-authorization-in-intersection)
- [OpenFGA case sensitivity mismatch in MySQL datastore](https://junglewise.ai/threats/cve-2026-55170-openfga-case-sensitivity-mismatch-in-mysql-datastore)
- [OpenFGA cache key collision in iterator caching](https://junglewise.ai/threats/cve-2026-48096-openfga-cache-key-collision-in-iterator-caching)
- [OpenFGA has Improper Policy Enforcement](https://junglewise.ai/threats/cve-2026-41131-openfga-has-improper-policy-enforcement)
- [OpenFGA API key exposure in playground endpoint](https://junglewise.ai/threats/cve-2026-40293-openfga-api-key-exposure-in-playground-endpoint)