Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
MEDIUM severity

OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unsetGHSA-hcxc-wf8j-23hv

MEDIUMFix: openfga/openfga@4459677

GHSA-hcxc-wf8j-23hv is a medium-severity (CVSS 6.8) Improper Authentication vulnerability in github.com/openfga/openfga. A fix is available for github.com/openfga/openfga — see the affected versions and patch details below.

Also known asCVE-2026-55689GO-2026-5423
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 12, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-hcxc-wf8j-23hv.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs33th percentile — riskier than 33% of all scored CVEsHighest risk
0.00%0.30%0.60%0.91%0.3%0.4%0.4%0.4%Aug 26Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-hcxc-wf8j-23hv by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
🐹github.com/openfga/openfga

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Description

OpenFGA's OIDC authenticator skipped JWT audience (aud) validation when no audience was configured. In deployments where one identity provider issues tokens for multiple services, a token minted for an unrelated service could authenticate to OpenFGA.

Preconditions

This applies if the following preconditions are met:

  1. You run OpenFGA with authn.method set to oidc.
  2. You configured authn.oidc.issuer but did not set authn.oidc.audience (--authn-oidc-audience / OPENFGA_AUTHN_OIDC_AUDIENCE).

Fix

Upgrade to OpenFGA 1.18.0 or greater. OpenFGA now refuses to start in oidc mode unless both authn.oidc.issuer and authn.oidc.audience are set, and the aud claim is always validated.

Acknowledgements

OpenFGA would like to thank https://github.com/0xVijay for the report.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/openfga/openfgaall versions1.18.0go get github.com/openfga/openfga@v1.18.0

Affected Products

2 products · 2 configurations
Application
helm chartsopenfga
< 0.3.9
range
Application
openfgaopenfga
< 1.18.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/openfga/openfga, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/openfga/openfga to 1.18.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hcxc-wf8j-23hv is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

OpenFGA, when run with OIDC authentication enabled (--authn-oidc-issuer) but with --authn-oidc-audience left unset, does not validate the JWT audience claim on incoming bearer tokens. This means a validly-signed OIDC access token issued by the same identity provider for a completely different application/audience will…

Workaround published by Red Hat
Administrators running OpenFGA with OIDC authentication enabled should set --authn-oidc-audience to the expected audience value for their deployment, restricting accepted tokens to those issued for OpenFGA itself. Upgrading to OpenFGA 1.18.0 or later, which restores audience validation by default, is the preferred long-term remediation.
Source: Red Hat security advisory for GHSA-hcxc-wf8j-23hv (CC BY 4.0)

Frequently Asked Questions

## Description OpenFGA's OIDC authenticator skipped JWT audience (`aud`) validation when no audience was configured. In deployments where one identity provider issues tokens for multiple services, a token minted for an unrelated service could authenticate to OpenFGA. ## Preconditions This applies if the following preconditions are met: 1. You run OpenFGA with `authn.method` set to `oidc`. 2. You configured `authn.oidc.issuer` but did **not** set `authn.oidc.audience` (`--authn-oidc-audience` / `OPENFGA_AUTHN_OIDC_AUDIENCE`). ## Fix Upgrade to OpenFGA 1.18.0 or greater. OpenFGA now ref
O3 Security · Impact-Aware SCA

Is GHSA-hcxc-wf8j-23hv in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
OpenFGA: OIDC audience validation skipped when…