The flaw arises from a JWT algorithm confusion in MinIO’s OIDC authentication path. By knowing the OIDC ClientSecret, an attacker can fabricate identity tokens that win the token verification step and gain S3 credentials. The issued credentials can include any policy, up to consoleAdmin, giving the attacker full control over the object storage instance. This leads to complete loss of confidentiality, integrity, and availability of stored data and the administrative interface.

This issue affects MinIO object storage versions between RELEASE.2022-11-08T05-27-07Z and just before RELEASE.2026-03-17T21-25-16Z. All installations of MinIO that use OpenID Connect for authentication in this period are vulnerable. Upgrade to the patched release from 2026‑03‑17 or later to eliminate the weakness.

The CVSS base score of 9.2 reflects a high severity, and the EPSS score indicates exploitation is unlikely (<1%). However, the vulnerability is still significant because the attacker only needs the OIDC ClientSecret, which could be leaked or accessed by an insider. The attack vector is inferred to be remote over the network, requiring access to the OIDC configuration. The CVE is not listed in the CISA KEV catalog, yet the potential for privilege escalation warrants immediate attention.