PT-2026-50974 · Openfga · Openfga

Published 2026-06-19 · Updated 2026-06-25 · CVE-2026-55689

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.18.0

Description The OIDC authenticator fails to validate the JWT audience (aud) claim when no audience is configured. In environments where a single identity provider issues tokens for multiple services, a token intended for a different service could be used to authenticate to OpenFGA. This occurs when authn.method is set to oidc and authn.oidc.issuer is configured without setting the authn.oidc.audience variable.

Recommendations Upgrade to version 1.18.0 or greater. Ensure both authn.oidc.issuer and authn.oidc.audience are configured to enable proper validation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-55689

GHSA-HCXC-WF8J-23HV

GO-2026-5423

Affected Products

Openfga

References · 4

• https://osv.dev/vulnerability/GO-2026-5423 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcxc-wf8j-23hv · Vendor Advisory
• https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv · Note
• https://github.com/openfga/openfga · Note