The vulnerability in Oxia’s OIDC authentication provider allows the SkipClientIDCheck flag to be set to true, effectively disabling audience claim validation. This means any token issued by the same OIDC issuer for unrelated services can be accepted by Oxia, permitting an attacker to impersonate legitimate users or services and gain unauthorized access. The identified weakness corresponds to CWE‑287, which concerns authentication bypass by failing to verify identity information properly.

Oxia installations from versions prior to 0.16.2 are affected. The product is the Oxia metadata store and coordination system provided by oxia-db:oxia. Users running any older minor release that has not incorporated the 0.16.2 update are vulnerable.

With a CVSS score of 9.2, this issue is considered of high severity. EPSS data is not available, but the vulnerability is not yet listed in CISA KEV. The likely attack vector is remote, where an adversary obtains or forges an OIDC token from the same issuer and presents it to Oxia. Because the standard audience check is bypassed, such a token would be accepted without further validation, enabling elevation of privilege or unauthorized access to the datastore.