OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-55689 · CVE overview and exploitation status

EUVD-2026-42710

GHSA-hcxc-wf8j-23hv

GO-2026-5423

cve-program · CVE-2026-55689

• https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv
• https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271
• https://github.com/openfga/helm-ch
• https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9
• https://github.com/openfga/openfga/releases/tag/v1.18.0

euvd · EUVD-2026-42710

• https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv
• https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271
• https://github.com/openfga/helm-ch
• https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9
• https://github.com/openfga/openfga/releases/tag/v1.18.0

nvd · CVE-2026-55689

• https://github.com/openfga/helm-ch
• https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9
• https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271
• https://github.com/openfga/openfga/releases/tag/v1.18.0
• https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv

osv · GHSA-hcxc-wf8j-23hv

• https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv
• https://nvd.nist.gov/vuln/detail/CVE-2026-55689
• https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271
• https://github.com/openfga/helm-ch
• https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9
• https://github.com/openfga/openfga
• https://github.com/openfga/openfga/releases/tag/v1.18.0

osv · GO-2026-5423

• https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv

No related changes are available here.