Description
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
openfga openfga
< 1.18.0affected
References
- https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv ↗
- https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271 ↗
- https://github.com/openfga/helm-ch ↗
- https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9 ↗
- https://github.com/openfga/openfga/releases/tag/v1.18.0 ↗