GHSA-5cx5-wh4m-82fh

Описание

Impact

What kind of vulnerability is it? Who is impacted?

A JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with any policy, including consoleAdmin.

An attacker with knowledge of the OIDC ClientSecret can:

• Impersonate any user identity
• Obtain S3 credentials with any IAM policy, including consoleAdmin
• Access, modify, or delete any data in the MinIO deployment

The attack is deterministic (100% success rate, no race conditions).

Attack Prerequisites

The attacker must know the OIDC ClientSecret. While this is a shared credential (not a private key), it is more accessible than commonly assumed:

• CVE-2023-28432 previously leaked environment variables including MINIO_IDENTITY_OPENID_CLIENT_SECRET
• Client secrets are often present in frontend OAuth configurations, mobile app bundles, CI/CD pipelines, and shared configuration files
• In many organizations, the client secret is accessible to operators and engineers who should not be able to forge arbitrary identities

Affected Versions

All MinIO releases from RELEASE.2022-11-08T05-27-07Z through the final release of the minio/minio open-source project.

Patches

Fixed in: MinIO AIStor RELEASE.2026-03-17T21-25-16Z

Downloads

Binary Downloads

FIPS Binaries

Package Downloads

Container Images

Homebrew (macOS)

Workarounds

• Users of the open-source minio/minio project should upgrade to MinIO AIStor RELEASE.2026-03-17T21-25-16Z or later.
• As a workaround, ensure that the OIDC ClientSecret is treated as a highly sensitive credential and is not exposed to untrusted parties.