The vulnerability in OpenFGA occurs when the playground feature is enabled and the server is configured to use preshared‑key authentication. In this configuration, requests to the /playground endpoint return the API key as part of the HTML payload. This disclosure of a secret credential can lead to credential compromise, allowing an attacker who can reach the host to authenticate to the service with elevated privileges. The weakness is an information‑disclosure flaw, categorized as CWE‑200, and an authentication bypass flaw, categorized as CWE‑201.

Products affected are OpenFGA, version range 0.1.4 through 1.13.1. The issue exists only when the server is started with the --authn-method preshared flag and the playground is enabled (the default). Systems that restrict the /playground endpoint to localhost or otherwise protected networks are not vulnerable. All other OpenFGA versions are unaffected.

The issue has a CVSS score of 6.5, indicating moderate severity. The EPSS score of 0.00056 indicates a very low probability of exploitation and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a network attacker who can reach the OpenFGA host and send an HTTP request to /playground. Because the endpoint requires no authentication, the attacker can obtain the preshared key directly. Once the key is known, it can be used to authenticate to the server, potentially giving the attacker full control over the authorization engine. The condition of the playground being accessible beyond localhost or from untrusted networks is a prerequisite, so securing the endpoint or disabling the playground mitigates the risk.