CVE-2026-33322 — MinIO: JWT Algorithm Confusion in OIDC Authentication

CVE-2026-33322

MinIO: JWT Algorithm Confusion in OIDC Authentication PUBLISHED

Description (CNA)

MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with any policy, including consoleAdmin. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.

Affected (CNA)

Vendor / product	Versions
minio / minio	affected >= RELEASE.2022-11-08T05-27-07Z, < RELEASE.2026-03-17T21-25-16Z

CWE

CWE-287

References

https://github.com/minio/minio/security/advisories/GHSA-5cx5-wh4m-82fh

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.