{"id":"CVE-2026-40946","aliases":["GHSA-fhvp-9hcj-6m33","GO-2026-5364"],"url":"https://o3.security/vulnerability/CVE-2026-40946","summary":"Oxia: OIDC token audience validation bypass via SkipClientIDCheck","details":"### Summary\nThe OIDC authentication provider unconditionally sets `SkipClientIDCheck: true` in the `go-oidc` verifier configuration, disabling the standard audience (`aud`) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia.\n\n### Impact\nIn deployments using OIDC authentication, an attacker possessing a valid JWT token issued by the same identity provider but intended for a different service (different `client_id`/`aud`) can authenticate to Oxia. This bypasses the intended audience isolation of OAuth2/OIDC.\n\nAll versions using OIDC authentication are affected.\n\n### Details\nIn `oxiad/common/rpc/auth/oidc.go`, both `createStaticKeyVerifier()` and `createRemoteVerifier()` set `SkipClientIDCheck: true`. While a custom audience check exists in `Authenticate()`, the library-level check — which validates the `aud` claim against the expected `client_id` — is completely bypassed.\n\n### Patches\nFixed by removing `SkipClientIDCheck: true` and setting the `ClientID` field from the configured `AllowedAudiences`.\n\n### Workarounds\nEnsure network-level isolation so that only trusted services can reach the Oxia gRPC endpoints.","published":"2026-04-21T21:18:12.103Z","modified":"2026-08-12T03:51:28.674496135Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/oxia-db/oxia","fixedVersion":"0.16.2"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40946.json"},{"type":"ADVISORY","url":"https://github.com/oxia-db/oxia/security/advisories/GHSA-fhvp-9hcj-6m33"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40946"},{"type":"PACKAGE","url":"https://github.com/oxia-db/oxia"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:28.674496135Z"}}