CVE-2026-55689: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
Description
OpenFGA's OIDC authenticator skipped JWT audience (aud) validation when no audience was configured. In deployments where one identity provider issues tokens for multiple services, a token minted for an unrelated service could authenticate to OpenFGA.
Preconditions
This applies if the following preconditions are met:
1. You run OpenFGA with authn.method set to oidc. 2. You configured authn.oidc.issuer but did not set authn.oidc.audience (--authn-oidc-audience / OPENFGAAUTHNOIDCAUDIENCE).
Fix
Upgrade to OpenFGA 1.18.0 or greater. OpenFGA now refuses to start in oidc mode unless both authn.oidc.issuer and authn.oidc.audience are set, and the aud claim is always validated.
Acknowledgements
OpenFGA would like to thank https://github.com/0xVijay for the report.
Other sources
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/openfga/openfgato a version that resolves this vulnerability.Fixed in 1.18.0 - Upgrade
Upgrade
OpenFGAto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55689?
CVE-2026-55689 has a medium severity score of 6.8.
What does CVE-2026-55689 affect?
CVE-2026-55689 affects OpenFGA's OIDC authenticator within the go/github.com/openfga/openfga software.
How can I fix CVE-2026-55689?
To mitigate CVE-2026-55689, ensure that audience validation is properly configured for your OpenFGA deployment.
What impact does CVE-2026-55689 have?
CVE-2026-55689 allows tokens from unrelated services to authenticate, leading to unauthorized access.
When was CVE-2026-55689 published?
CVE-2026-55689 was published on June 19, 2026.