CVE-2026-82454: Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Omnivore API (packages/api)to a version that resolves this vulnerability.Fixed in android-0.227.0Patch abf53d6 - Configuration
Update Apple sign-in token verification so jwt.verify() does not take the allowed algorithm(s) from the attacker-controlled JWT header ('alg'). Instead, enforce the expected algorithm(s) for Apple-issued tokens when verifying the token signature.
decodeAppleToken / jwt.verify() (Omnivore API, packages/api) Allowed JWT algorithm enforcement = Do not derive allowed algorithms solely from the attacker-supplied JWT header (alg); use the expected fixed algorithm(s) for Apple tokens