CVE-2026-82454
Received Received - Intake

Authentication Bypass in Omnivore API via Apple Sign-In Token

Publication date: 2026-08-29

Last updated on: 2026-08-29

Assigner: VulnCheck

Description
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-29
Last Modified
2026-08-29
Generated
2026-08-29
AI Q&A
2026-08-29
EPSS Evaluated
N/A
NVD
CVE-2026-82454
EUVD
EUVD-2026-68109

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jsonwebtoken jsonwebtoken 8
omnivore omnivore to 0.227.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82454 is an authentication bypass in Omnivore's Apple Sign-in functionality. The vulnerability exists in the decodeAppleToken function which improperly verified cryptographic signatures. An attacker could manipulate the JWT header's 'alg' field to set it to HS256, then sign a forged token using Apple's RSA public key as an HMAC secret. This bypassed signature verification, allowing impersonation of any Apple-linked account.

Detection Guidance

To detect this vulnerability, check if your Omnivore API version is before commit abf53d650875. Inspect the decodeAppleToken function in the API package for improper JWT algorithm handling. Look for instances where the alg field is extracted from JWT headers and passed to jwt.verify().

Commands: Check Omnivore version with git log --oneline | grep abf53d6. Review apple_auth.ts for decodeAppleToken function implementation. Use jwt debugging tools to test token verification logic.

Impact Analysis

This vulnerability allows attackers to gain unauthorized access to user accounts linked via Apple Sign-in. An attacker could impersonate any user, access their data, perform actions on their behalf, or take over their account entirely. The impact includes potential data theft, unauthorized actions, and loss of account control for affected users.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA. It enables unauthorized access to personal data, which could result in data breaches. Organizations using vulnerable versions would fail to implement proper access controls and authentication mechanisms, leading to potential regulatory penalties and loss of compliance certifications.

Mitigation Strategies

Immediately update Omnivore to a version after commit abf53d650875 or apply Pull Request #4652. Ensure the decodeAppleToken function hardcodes RS256 as the only allowed algorithm in jwt.verify().

If updating is not possible, disable Apple Sign-in functionality temporarily. Monitor for suspicious authentication attempts or unauthorized account access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82454. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart