What’s Vulnerable › Vulnerabilities
CVE-2026-40946: Oxia: OIDC token audience validation bypass via SkipClientIDCheck
- Severity: critical (CVSS 9.2 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-21 · updated 2026-06-17
- Weakness: CWE-287
Description
Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia. This vulnerability is fixed in 0.16.2.
Affected products
- oxia-db oxia: before 0.16.2
References
Get alerted when CVE-2026-40946 or the next vulnerability affects your stack