CyberRota Analysis
AI-GeneratedOpenFGA versions prior to 1.18.0 are vulnerable due to a flaw in the OIDC authenticator that bypasses JWT audience validation under specific configuration conditions, potentially allowing unauthorized access via tokens from unrelated services. This could lead to unauthorized actions within applications that rely on OpenFGA for authorization. Developers and organizations using OpenFGA should prioritize upgrading to version 1.18.0 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)