OpenFGA has an Authorization Bypass through cached keys

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-33729 · CVE overview and exploitation status

EUVD-2026-16507

GHSA-h6c8-cww8-35hf

GO-2026-4857

cve-program · CVE-2026-33729

• https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf
• https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8
• https://github.com/openfga/openfga/releases/tag/v1.13.1

euvd · EUVD-2026-16507

• https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf
• https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8
• https://github.com/openfga/openfga/releases/tag/v1.13.1

nvd · CVE-2026-33729

• https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8
• https://github.com/openfga/openfga/releases/tag/v1.13.1
• https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf

osv · GHSA-h6c8-cww8-35hf

• https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf
• https://nvd.nist.gov/vuln/detail/CVE-2026-33729
• https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8
• https://github.com/openfga/openfga
• https://github.com/openfga/openfga/releases/tag/v1.13.1

osv · GO-2026-4857

• https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf
• https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8
• https://github.com/openfga/openfga/releases/tag/v1.13.1

No related changes are available here.