Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-82454
- 2026-10-03 Alias added: GHSA-8fpq-5wcx-76h3
References
More omnivore-app vulnerabilities
- TI-2026-53820 Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation CVSS 4.0MEDIUM 5.3
- TI-2026-53819 Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-82454 · CVE Program
- CVE-2026-82454 · NVD
- FIRST EPSS
- GHSA-8fpq-5wcx-76h3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences