Farcaller

**Name of the Vulnerable Software and Affected Versions** Argo CD versions 1.8.2 through 2.3.12 Argo CD versions 2.4.0 through 2.4.18 Argo CD versions 2.5.0 through 2.5.5 Argo CD versions 2.6.0-rc0 through 2.6.0-rc2 **Description** The issue is related to an improper authorization bug in Argo CD, causing the API to accept certain invalid tokens. OIDC providers include an `aud` (audience) claim in signed tokens, specifying the intended audience of the token. However, Argo CD does not validate the audience claim, allowing it to accept tokens not intended for Argo CD. If the configured OIDC provider serves other audiences, Argo CD will accept a token intended for one of those other audiences and grant user privileges based on the token's `groups` claim. This bug increases the impact of a stolen token, as an attacker can use a valid token for a different audience to access Argo CD. **Recommendations** For versions 1.8.2 through 2.3.12, update to version 2.3.13 or later. For versions 2.4.0 through 2.4.18, update to version 2.4.19 or later. For versions 2.5.0 through 2.5.5, update to version 2.5.6 or later. For versions 2.6.0-rc0 through 2.6.0-rc2, update to version 2.6.0-rc3 or later. As a temporary workaround, consider configuring the `allowedAudiences` option in the OIDC config block to specify the intended audiences for the token.

**Name of the Vulnerable Software and Affected Versions** Envoy version 1.17.0 **Description** The issue allows an attacker to bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the `allow missing` requirement under `requires any`. This is due to a mistake in implementation where a JwtUnknownIssuer error was mistakenly converted to JwtMissed when `requires any` was configured. As a result, `allow missing` would allow a JWT token with an unknown issuer status, potentially impacting integrity depending on configuration if the JWT token is used to protect against writes or modifications. **Recommendations** For Envoy version 1.17.0, update to version 1.17.1 to fix the issue. As a temporary workaround, consider disabling the `allow missing` requirement under `requires any` in the JWT Authentication filter configuration until the update is applied. Additionally, users can enable component-level debug logs for JWT to detect potential bypass attempts, which will indicate a request with a JWT token and a failure that the JWT token is missing.