OIDC token audience validation bypass in Oxia (CVE-2026-40946)

The OIDC authentication provider in Oxia unconditionally sets `SkipClientIDCheck: true` in the go-oidc verifier configuration, disabling standard audience (`aud`) claim validation at the library level. As a result, an attacker holding a valid JWT issued by the same identity provider for a different service can authenticate to Oxia, bypassing the intended OAuth2/OIDC audience isolation. Affected versions: - <= 0.16.1 We recommend updating to: 0.16.2. CVSS 9.2 · our assessment: act_now Reference: https://github.com/oxia-db/oxia/security/advisories/GHSA-fhvp-9hcj-6m33 Details: https://vuln.today/cve/CVE-2026-40946