by Kastro
Paper/Archive/CVE-2026-40946

CVE-2026-40946

oxia-db oxia — Oxia: OIDC token audience validation bypass via SkipClientIDCheck

EPSS 0.3%CVSS 9.2
critical.is priorityof 100
31
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 17.1.171 × 203.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia. This vulnerability is fixed in 0.16.2.

Affected

ProductAffectedFixed inSource
oxia< 0.16.2–CNA

Scores by source

GitHub_M (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/oxia-db/oxia/security/advisories/GHSA-fhvp-9hcj-6m33