Executive brief
Omnivore is an open-source read-it-later application that allows users to save and manage articles. The API's Apple sign-in feature contains a critical flaw that permits attackers to forge authentication tokens and take over any Apple-linked user account without knowing the password. An attacker could impersonate legitimate users, access their saved content, and potentially modify or delete their data.
Technical details
The vulnerability is an algorithm confusion attack in the decodeAppleToken function, which implements JWT verification for Apple sign-in. The vulnerable code extracts the 'alg' field directly from the attacker-supplied JWT header and passes it as the sole allowed algorithm to jsonwebtoken's jwt.verify() method. With jsonwebtoken v8 (which does not validate key-algorithm type compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as an HMAC secret, bypassing signature verification. The attack requires network access to the authentication endpoint but no prior authentication or user interaction. The fix (commit abf53d6) hardens the verification to explicitly allow only RS256, the sole algorithm that Apple's identity service uses.
Affected products
- Omnivore Omnivore API before commit abf53d6
Timeline
- 2026-08-29: disclosed: CVE-2026-82454 published on NVD
- 2026-08-29: patched: Fix committed as abf53d6, hardcodes RS256 algorithm