CVE Intelligence
Analysis AI-assisted

CVE-2026-40946: Oxia: OIDC token audience validation bypass via SkipClientIDCheck

Oxia versions before 0.16.2 set SkipClientIDCheck to true in the go-oidc verifier configuration, which disables the standard audience check for OIDC tokens. As a result, tokens issued for unrelated services by the same OIDC issuer may be accepted. The record reports a CVSS score of 9.2 and states that the issue is fixed in 0.16.2.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Oxia is a metadata store and coordination system. According to the GitHub advisory referenced in the record, its OIDC authentication provider unconditionally sets SkipClientIDCheck to true in the go-oidc verifier configuration, which disables the standard audience (aud) claim check at the library level. The weakness is classified as CWE-287 (Improper Authentication). See GitHub advisory GHSA-fhvp-9hcj-6m33.

Impact

  • Tokens issued for unrelated services by the same OIDC issuer may be accepted by Oxia.
  • The record assigns a CVSS score of 9.2 with a critical severity label, and lists high confidentiality, integrity and availability impact on the vulnerable system.

Affected products and versions

  • Oxia (Oxia-db Oxia): versions before 0.16.2.
  • The record states that the issue is fixed in 0.16.2.

Exploitation status

The CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation appears in the sources consulted. The SSVC data in the record lists exploitation as none and automatable as no.

Remediation and mitigation

  • Upgrade Oxia to 0.16.2 or later, as stated in the record and the referenced advisory.
  • Until the upgrade is applied, review the OIDC configuration, confirm which token issuers and client applications are trusted, and limit which issuers can reach Oxia.
  • Check whether the OIDC issuer also issues tokens for other services and whether those tokens should be accepted by Oxia.

Detection guidance

  • Review authentication logs for requests accepted with tokens from unexpected client applications or audiences.
  • Monitor for access by identities that do not belong to the expected set of Oxia workloads.

Limitations of the available information

  • The record contains an empty fixes list; the fixed version is taken from the description and the allowed versions.
  • The record does not describe observed attacks or a public proof of concept.
  • The EPSS date in the record (2026-10-23) is later than the publication date, so it should be treated as unverified.
  • The version of the go-oidc library used by Oxia is not stated.

Frequently asked questions

What does the Oxia vulnerability allow?

According to the record, tokens issued for unrelated services by the same OIDC issuer can be accepted by Oxia because the audience check is disabled.

Which Oxia versions are affected?

The record lists Oxia versions before 0.16.2 as affected, and states that the issue is fixed in 0.16.2.

Is this vulnerability being actively exploited?

The record does not list the CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.