Read the docs
TI-2026-40204 Aliases CVE-2026-55689GHSA-hcxc-wf8j-23hv

OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset

Priority LOW 35CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00407 35th percentileScored 2026-11-07
Fix Partial openfga (openfga): 1.18.0github.com/openfga/openfga (Go): 1.18.0Red Hat: 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openfgaopenfgabefore 1.18.01.18.0Patch availableCNA
—github.com/openfga/openfga (Go)before 1.18.01.18.0Patch availableGHSA-hcxc-wf8j-23hv
  • openfga Vendoropenfga Affected before 1.18.0 Fixed in 1.18.0 Patch available CNA
  • github.com/openfga/openfga (Go) Vendor— Affected before 1.18.0 Fixed in 1.18.0 Patch available GHSA-hcxc-wf8j-23hv

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openfga:helm_charts:*:*:*:*:*:openfga:*:*before 0.3.9Vulnerableopenfga
cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*before 1.18.0Vulnerableopenfga
  • cpe:2.3:a:openfga:helm_charts:*:*:*:*:*:openfga:*:* Versions before 0.3.9 Vulnerable ·openfga
  • cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:* Versions before 1.18.0 Vulnerable ·openfga

Remediation

  • Fix · CNA openfga (openfga) Fixed in 1.18.0
  • Fix · GHSA-hcxc-wf8j-23hv github.com/openfga/openfga (Go) Fixed in 1.18.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multicluster Global HubAffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55689
  2. 2026-10-03 Alias added: GHSA-hcxc-wf8j-23hv

References

Patch 1

Advisory 2

Other 4

  • TI-2026-27194 Incorrect authorization in openfga CVSS 3.1HIGH 8.8
  • TI-2025-30697 OpenFGA Authorization Bypass CVSS 4.0MEDIUM 5.8
  • TI-2026-20050 OpenFGA Improper Policy Enforcement CVSS 4.0MEDIUM 5.8
  • TI-2025-40089 OpenFGA Improper Policy Enforcement CVSS 4.0MEDIUM 5.8
  • TI-2025-34888 OpenFGA Authorization Bypass (Check) CVSS 4.0MEDIUM 5.8
  • TI-2025-29072 OpenFGA Authorization Bypass CVSS 4.0MEDIUM 5.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences