CVE-2026-55689

EUVD-2026-42710
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 22.81%
Affected Products (NVD)
VendorProductVersion
openfgahelm_charts
𝑥
< 0.3.9
openfgaopenfga
𝑥
< 1.18.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/openfga/helm-ch
https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9
https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271
https://github.com/openfga/openfga/releases/tag/v1.18.0
https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv