The vulnerability is an authentication bypass in Omnivore's API. The decodeAppleToken function extracts the 'alg' field from a JWT header supplied by the attacker and uses it as the sole allowed algorithm for jwt.verify(). With jsonwebtoken v8, which does not enforce key/algorithm compatibility, an attacker can set alg=HS256 and sign a fake token using Apple's RSA public key as the HMAC secret, thereby sidestepping signature verification and impersonating any Apple-linked account.

Affected systems are Omnivore App users running versions of the Omnivore API prior to the fix applied in commit abf53d6508755d3d22a994e28e370a9193ea977a (approximately before Android 0.227.0). The vendor is omnivore-app:omnivore. Any deployment of the API that has not integrated the patch is vulnerable.

The CVSS score of 9.3 indicates a critical risk with high impact on confidentiality and integrity. EPSS is not available, so the current exploitation probability cannot be quantified, but because the vulnerability allows remote token forgery without additional system access, it is considered high risk. The vulnerability is not yet in CISA's KEV catalog. Attackers only need the ability to send a custom JWT to the ingestion endpoint; no local privileges or elevated privileges are required.