CVE-2026-40946 — Oxia: OIDC token audience validation bypass via SkipClientIDCheck

CVE-2026-40946

Oxia: OIDC token audience validation bypass via SkipClientIDCheck PUBLISHED

Description (CNA)

Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia. This vulnerability is fixed in 0.16.2.

Affected (CNA)

Vendor / product	Versions
oxia-db / oxia	affected < 0.16.2

CWE

CWE-287

References

https://github.com/oxia-db/oxia/security/advisories/GHSA-fhvp-9hcj-6m33

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.