Vulnerabilities

TI-2026-56851 CVE-2026-82454 · GHSA-8fpq-5wcx-76h3

Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in

MEDIUM 46

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00386 Published 2026-08-29 Fixed CWE-347

TI-2026-53820 CVE-2026-77067 · GHSA-w562-g8x6-3cj6

Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation

MEDIUM 57

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00269 Published 2026-08-20 Fixed CWE-918

TI-2026-53819 CVE-2026-77066 · GHSA-w9wc-vx4j-8xwg

Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query

MEDIUM 57

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00251 Published 2026-08-20 Fixed CWE-918

Vulnerabilities

Filters

Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in

Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation

Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query