Описание
OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
Description
OpenFGA's OIDC authenticator skipped JWT audience (aud) validation when no audience was configured.
In deployments where one identity provider issues tokens for multiple services,
a token minted for an unrelated service could authenticate to OpenFGA.
Preconditions
This applies if the following preconditions are met:
- You run OpenFGA with
authn.methodset tooidc. - You configured
authn.oidc.issuerbut did not setauthn.oidc.audience(--authn-oidc-audience/OPENFGA_AUTHN_OIDC_AUDIENCE).
Fix
Upgrade to OpenFGA 1.18.0 or greater. OpenFGA now refuses to start in oidc
mode unless both authn.oidc.issuer and authn.oidc.audience are set, and the
aud claim is always validated.
Acknowledgements
OpenFGA would like to thank https://github.com/0xVijay for the report.
Ссылки
- https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv
- https://nvd.nist.gov/vuln/detail/CVE-2026-55689
- https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271
- https://github.com/openfga/helm-ch
- https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9
- https://github.com/openfga/openfga/releases/tag/v1.18.0
Пакеты
github.com/openfga/openfga
<= 1.17.1
1.18.0
Связанные уязвимости
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.