CVE-2026-55689: OpenFGA OIDC Authentication Bypass via Missing Audience Validation

Technical summary

CVE-2026-55689 is an authentication bypass vulnerability stemming from incomplete JWT validation in OpenFGA's OIDC authenticator. When authn.method is set to 'oidc' and authn.oidc.issuer is configured, the system skipped the JWT audience (aud) claim validation if authn.oidc.audience was not explicitly set. This allows tokens issued by the same identity provider but intended for unrelated services to successfully authenticate against the affected OpenFGA instance. The vulnerability is rooted in CWE-287 (Improper Authentication) and affects the authorization decision chain at the entry point. Version 1.18.0 introduces proper audience validation, making the aud claim check mandatory when OIDC is enabled.

Business impact

Organizations relying on OpenFGA for access control decisions face unauthorized access risk if they have deployed vulnerable versions with OIDC authentication enabled. The impact depends on what protected resources or operations the OpenFGA instance governs. An attacker with valid credentials in the same identity provider ecosystem (e.g., a former contractor with access to a related internal service) could bypass authentication controls and potentially escalate privileges or access sensitive data. The vulnerability is most dangerous in multi-tenant or microservices environments where token reuse across service boundaries is possible. Remediation is straightforward and does not require architectural changes.

Affected systems

OpenFGA versions prior to 1.18.0 are affected when deployed with OIDC authentication configured. Both the openfga/openfga container image and openfga Helm charts delivering versions before 1.18.0 are in scope. Systems using alternative authentication methods (API keys, mTLS, or local authentication) are not affected. Environments where authn.oidc.audience is already explicitly configured are protected from this specific attack vector.

Exploitability

Exploitation requires an attacker to hold valid credentials issued by the same OIDC identity provider and have network access to the OpenFGA instance. The CVSS score of 6.8 (MEDIUM) reflects the combination of high impact (confidentiality and integrity) offset by the higher barriers to entry (authentication required, less common configuration). The vulnerability is not known to be actively exploited in the wild and has not been added to CISA's Known Exploited Vulnerabilities catalog. An attacker cannot exploit this remotely without valid OIDC credentials, which is the primary limiting factor.

Remediation

Upgrade OpenFGA to version 1.18.0 or later. For organizations unable to upgrade immediately, implement defense-in-depth by explicitly configuring the authn.oidc.audience parameter to restrict accepted tokens to those minted specifically for your OpenFGA deployment. Additionally, conduct an audit of identity provider trust relationships and enforce principle of least privilege within OIDC issuer configurations. Monitor authentication logs for tokens originating from unexpected service identities.

Patch guidance

Obtain OpenFGA 1.18.0 or later from the official openfga/openfga repository. If deploying via Helm, update the chart to a version that bundles 1.18.0 or later of the OpenFGA application. Verify the patch is in place by confirming the application version in startup logs or by checking the /health endpoint if exposed. Test authentication flows in a non-production environment before production rollout to ensure OIDC configuration remains compatible with your identity provider setup.

Detection guidance

Search logs for authentication requests using OIDC tokens where the audience claim does not match your configured service identity. Enable verbose logging on the OIDC authenticator if available. Examine OIDC token metadata (via JWT decoding) for evidence of tokens minted for unrelated services. Monitor for failed authorization decisions following successful authentication, which may indicate token reuse from unintended sources. If possible, enable audit logging on your identity provider to detect tokens issued for your OpenFGA service being used elsewhere.

Why prioritize this

This vulnerability warrants prompt but not emergency attention. The CVSS score of 6.8 and authentication requirement mean it is less critical than network-reachable unauthenticated flaws, but the direct impact on authorization decisions makes it more serious than many medium-severity issues. Organizations with OIDC-based OpenFGA deployments should prioritize this within a standard patching cycle. The fix is low-risk and the configuration gap is easily identified through review of existing deployment manifests.

Risk score, explained

The CVSS 3.1 score of 6.8 (MEDIUM) reflects: high impact on confidentiality and integrity (C:H/I:H) because successful exploitation bypasses access controls; network accessibility (AV:N); requirement for prior authentication (PR:L), which limits attacker population; and high complexity (AC:H) due to the specific configuration required to trigger the flaw. The score appropriately captures that this is not a critical flaw but poses meaningful risk in certain deployment patterns.

Frequently asked questions