PT-2026-34190 · Oxia · Oxia

Published 2026-04-14 · Updated 2026-04-26 · CVE-2026-40946

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Oxia versions prior to 0.16.2

Description The OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration. This disables the standard audience (aud) claim validation at the library level, allowing tokens issued for unrelated services by the same OIDC issuer to be accepted. Consequently, any JWT from the same issuer can grant full access regardless of the intended audience.

Recommendations Update to version 0.16.2.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-40946

GHSA-FHVP-9HCJ-6M33

Affected Products

Oxia

References · 6

• https://osv.dev/vulnerability/GHSA-fhvp-9hcj-6m33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40946 · Security Note
• https://github.com/oxia-db/oxia · Note
• https://github.com/oxia-db/oxia/security/advisories/GHSA-fhvp-9hcj-6m33 · Note
• https://twitter.com/CVEnew/status/2048481092772991004 · Twitter Post
• https://twitter.com/0dayPublishing/status/2046705493712699764 · Twitter Post