https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 12:35:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292647 EUVD-2026-292647 https://cve.radiocsirt.org/vuln/euvd-2026-292647 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40946 <p>Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia. This vulnerability is fixed in 0.16.2.</p> <p>Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia. This vulnerability is fixed in 0.16.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40946 https://cve.radiocsirt.org/vuln/ghsa-fhvp-9hcj-6m33 <p><strong>Affected:</strong> Go: github.com/oxia-db/oxia</p> <p>### Summary The OIDC authentication provider unconditionally sets `SkipClientIDCheck: true` in the `go-oidc` verifier configuration, disabling the standard audience (`aud`) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia.</p> <p>### Impact In deployments using OIDC authentication, an attacker possessing a valid JWT token issued by the same identity provider but intended for a different service (different `client_id`/`aud`) can authenticate to Oxia. This bypasses the intended audience isolation of OAuth2/OIDC.</p> <p>All versions using OIDC authentication are affected.</p> <p>### Details In `oxiad/common/rpc/auth/oidc.go`, both `createStaticKeyVerifier()` and `createRemoteVerifier()` set `SkipClientIDCheck: true`. While a custom audience check exists in `Authenticate()`, the library-level check — which validates the `aud` claim against the expected `client_id` — is completely bypassed.</p> <p>### Patches Fixed by removing `SkipClientIDCheck: true` and setting the `ClientID` field from the configured `AllowedAudiences`.</p> <p>### Workarounds Ensure network-level isolation so that only trusted services can reach the Oxia gRPC endpoints.</p> <p><strong>Affected:</strong> Go: github.com/oxia-db/oxia</p> <p>### Summary The OIDC authentication provider unconditionally sets `SkipClientIDCheck: true` in the `go-oidc` verifier configuration, disabling the standard audience (`aud`) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia.</p> <p>### Impact In deployments using OIDC authentication, an attacker possessing a valid JWT token issued by the same identity provider but intended for a different service (different `client_id`/`aud`) can authenticate to Oxia. This bypasses the intended audience isolation of OAuth2/OIDC.</p> <p>All versions using OIDC authentication are affected.</p> <p>### Details In `oxiad/common/rpc/auth/oidc.go`, both `createStaticKeyVerifier()` and `createRemoteVerifier()` set `SkipClientIDCheck: true`. While a custom audience check exists in `Authenticate()`, the library-level check — which validates the `aud` claim against the expected `client_id` — is completely bypassed.</p> <p>### Patches Fixed by removing `SkipClientIDCheck: true` and setting the `ClientID` field from the configured `AllowedAudiences`.</p> <p>### Workarounds Ensure network-level isolation so that only trusted services can reach the Oxia gRPC endpoints.</p> https://cve.radiocsirt.org/vuln/ghsa-fhvp-9hcj-6m33