OpenFGA JWT Authentication Bypass via Missing Audience Validation

Compliance Impact

This vulnerability allows tokens minted for unrelated services by the same identity provider to authenticate to OpenFGA due to skipped JWT audience validation. This could lead to unauthorized access to sensitive data or systems.

Such unauthorized access risks violating data protection and privacy requirements outlined in standards like GDPR and HIPAA, which mandate strict access controls and authentication mechanisms to protect personal and health information.

Therefore, this vulnerability potentially undermines compliance with these regulations by weakening authentication controls and increasing the risk of data breaches.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in OpenFGA versions prior to 1.18.0, where the OIDC authenticator did not properly validate the JWT audience claim under certain configurations. Specifically, if the authentication method was set to OIDC, the issuer was configured, but the audience was not set, the system would skip audience validation. This allowed a token issued for a different service by the same identity provider to be accepted by OpenFGA, potentially granting unauthorized access.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized authentication to OpenFGA using tokens intended for other services. This means an attacker with a valid token for a different service under the same identity provider could gain access to OpenFGA, potentially compromising confidentiality and integrity of the authorization system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade OpenFGA to version 1.18.0 or later, where the issue with skipped JWT audience validation has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the OpenFGA configuration and version in use. Specifically, verify if the OpenFGA version is earlier than 1.18.0 and if the OIDC authenticator is configured with the authentication method set to oidc but without the audience parameter (authn.oidc.audience) set.

To detect vulnerable configurations, you can:

• Check the OpenFGA version to confirm if it is below 1.18.0.
• Inspect the OpenFGA configuration file or environment variables for the presence and values of authn.method, authn.oidc.issuer, and authn.oidc.audience.
• Look for missing or empty authn.oidc.audience settings when authn.method is set to oidc.

Example commands to assist in detection might include:

• To check OpenFGA version: `openfga version` or check the running container/image tag.
• To inspect configuration files (assuming a typical config file path): `grep -E 'authn.method|authn.oidc.issuer|authn.oidc.audience' /path/to/openfga/config.yaml`
• To check environment variables (if OpenFGA is run with env vars): `env | grep -E 'AUTHN_METHOD|AUTHN_OIDC_ISSUER|AUTHN_OIDC_AUDIENCE'`

If the audience parameter is missing or empty and the version is below 1.18.0, the system is vulnerable to this issue.

Useful 0 Not Useful 0