VULNERABILITY INTELLIGENCE

CVE-2026-55689

CVSS score6.8 MEDIUM
EPSS probability0.41%
CISA KEVNot currently listed
Published2026-07-09
Last modified2026-07-14
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.

Weakness classification

  • CWE-287: Improper Authentication

Primary references