| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| github.com/openfga/openfga | < 1.18.0 | 1.18.0 |
| helm charts | < 0.3.9 | 0.3.9 |
| openfga | < 1.18.0 | 1.18.0 |
OpenFGA's OIDC authenticator skipped JWT audience (aud) validation when no audience was configured.
In deployments where one identity provider issues tokens for multiple services,
a token minted for an unrelated service could authenticate to OpenFGA.
This applies if the following preconditions are met:
authn.method set to oidc.authn.oidc.issuer but did not set
authn.oidc.audience (--authn-oidc-audience / OPENFGA_AUTHN_OIDC_AUDIENCE).Upgrade to OpenFGA 1.18.0 or greater. OpenFGA now refuses to start in oidc
mode unless both authn.oidc.issuer and authn.oidc.audience are set, and the
aud claim is always validated.
OpenFGA would like to thank https://github.com/0xVijay for the report.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí