GHSA-hcxc-wf8j-23hv: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
Description
OpenFGA's OIDC authenticator skipped JWT audience (aud) validation when no audience was configured.
In deployments where one identity provider issues tokens for multiple services,
a token minted for an unrelated service could authenticate to OpenFGA.
Preconditions
This applies if the following preconditions are met:
1. You run OpenFGA with authn.method set to oidc.
2. You configured authn.oidc.issuer but did not set
authn.oidc.audience (--authn-oidc-audience / OPENFGA_AUTHN_OIDC_AUDIENCE).
Fix
Upgrade to OpenFGA 1.18.0 or greater. OpenFGA now refuses to start in oidc
mode unless both authn.oidc.issuer and authn.oidc.audience are set, and the
aud claim is always validated.
Acknowledgements
OpenFGA would like to thank https://github.com/0xVijay for the report.
Details
Original advisory: https://github.com/advisories/GHSA-hcxc-wf8j-23hv
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-556890.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-55689 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from GitHub Security Advisories
- mediumGHSA-xm43-3m56-w3wf: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature2026-08-04
- mediumGHSA-chgm-3698-jm42: Ghost: Member existence leak via magic link sign-in response2026-08-04
- highGHSA-xpp7-93x6-v29m: XSS in Ghost's ActivityPub client2026-08-04
- mediumGHSA-7mpp-r37j-x5wh: Ghost: Session Fixation in Ghost Admin2026-08-04
- mediumGHSA-cjc9-q5gf-327p: Ghost: Theme Upload Path Traversal2026-08-04