OpenFGA is an authorization/permission engine built for developers. Prior to version 1.18.0, the OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in version 1.18.0.

The affected product is OpenFGA, version 1.17.x and earlier. Versions prior to 1.18.0 are vulnerable. All installations that use OIDC authentication with the issuer configured but without setting the audience parameter are susceptible.

The 6.8 indicates a moderate severity flaw. EPSS score is < 1%, and the vulnerability is not listed in CISA KEV, indicating a low probability of exploitation. The likely attack vector involves a remote attacker obtaining or forging a JWT from the same identity provider for an unrelated audience and presenting it to OpenFGA with no audience check, thereby authenticating themselves as any user.