6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-68m9-983m-f3v5

GHSA-68m9-983m-f3v5: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response

Description

When OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. The /playground endpoint is enabled by default and does not require authentication. It is intended for local development and debugging and is not designed to be exposed to production environments.

Am I Affected?

You are affected if you meet each of the following preconditions:

You are running OpenFGA with --authn-method preshared, and
The playground is enabled, and
The playground endpoint is accessible beyond localhost or trusted networks.

Fix

Upgrade to OpenFGA v1.14.0, or disable the playground by running ./openfga run --playground-enabled=false.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-68m9-983m-f3v5

GHSA-68m9-983m-f3v5:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openfga/openfga	go	>= 0.1.4, <= 1.13.1	1.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the OpenFGA playground endpoint, which, when enabled with preshared-key authentication, would expose the key in the HTML source of the playground page. The analysis of the patch between the last vulnerable version (v1.13.1) and the first patched version (v1.14.0) revealed the exact code changes made to fix this issue. The commit 81373f28921554ab41232af10f762180d461a776 contains the security fix.

The core of the vulnerability was in the ServerContext.runPlaygroundServer function in cmd/run/run.go. This function previously allowed the playground to run with preshared authentication, which led to the key being passed to and rendered by the HTML template. The patch modifies this function to only allow the none authentication method when the playground is enabled.

Additionally, a faulty validation function, Config.VerifyBinarySettings in pkg/server/config/config.go, was identified. This function was supposed to validate server settings but incorrectly permitted the vulnerable configuration. The patch strengthens this validation to prohibit enabling the playground with any authentication method other than none. Both functions are therefore identified as vulnerable, one for executing the vulnerable logic and the other for failing to prevent it.

Vulnerable functions

ServerContext.runPlaygroundServer

cmd/run/run.go

This function was responsible for starting the playground web server. Before the patch, it allowed the server to start with the 'preshared' authentication method. When started in this mode, the function would pass the preshared keys to the HTML template, which were then rendered in the response of the '/playground' endpoint, exposing them to any user who could access it.

Config.VerifyBinarySettings

pkg/server/config/config.go

This function is a configuration validation control that is executed at startup. It was flawed because it failed to prevent the server from starting with the insecure combination of the playground being enabled and the authentication method set to 'preshared'. The patch corrects this logic to explicitly disallow this combination, thus preventing the vulnerable state from being reached.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.