Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/openfga/openfga | go | <= 1.17.1 | 1.18.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the OIDC authentication mechanism of OpenFGA, where JWT audience validation was skipped if no audience was explicitly configured. This could allow an attacker to use a valid JWT from the same identity provider, but intended for a different service, to authenticate to OpenFGA.
The analysis of the patch between the vulnerable version 1.17.1 and the patched version 1.18.0 revealed the exact code changes that address this issue.
The core of the vulnerability is in the Authenticate method of the RemoteOidcAuthenticator. In vulnerable versions, this method only added the audience validation to the JWT parser options if an audience was configured. The patch removes this conditional logic, making audience validation mandatory.
To support this, the NewRemoteOidcAuthenticator constructor was updated to return an error if the audience is not provided, preventing the creation of an authenticator in an insecure state. This is the root cause of the vulnerability, as it allowed the authenticator to be misconfigured.
Additionally, as a defense-in-depth measure, the VerifyBinarySettings function in the server configuration was updated to prevent the OpenFGA server from even starting if it's configured to use OIDC authentication without both an issuer and an audience being set.
Therefore, during exploitation on a vulnerable instance, the oidc.(*RemoteOidcAuthenticator).Authenticate function would be present in the runtime profile as it processes the malicious JWT. The oidc.NewRemoteOidcAuthenticator function is what sets up this vulnerable condition.
oidc.NewRemoteOidcAuthenticatorinternal/authn/oidc/oidc.go
oidc.(*RemoteOidcAuthenticator).Authenticateinternal/authn/oidc/oidc.go
config.(*Config).VerifyBinarySettingspkg/server/config/config.go