EUVD-2026-24512
GHSA-fhvp-9hcj-6m33
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because a valid same-issuer token for another service must first be obtained; PR:N as no Oxia credential is required; full C/I/A since authenticated access exposes the whole store.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7DescriptionGitHub Advisory
Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia. This vulnerability is fixed in 0.16.2.
AnalysisAI
Authentication bypass in Oxia (oxia-db) metadata store and coordination system prior to 0.16.2 allows an attacker holding a valid OIDC/JWT token issued for a different service by the same identity provider to authenticate to Oxia. The OIDC provider unconditionally set SkipClientIDCheck: true in the go-oidc verifier, disabling library-level audience (aud) validation and breaking the audience/tenant isolation that OAuth2/OIDC relies on. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and CISA SSVC records no known exploitation, but the technical impact is rated total.
Technical ContextAI
Oxia uses the go-oidc library to verify JWT bearer tokens for its gRPC authentication. In oxiad/common/rpc/auth/oidc.go, both createStaticKeyVerifier() and createRemoteVerifier() set SkipClientIDCheck: true, which instructs go-oidc to skip validating the token's aud (audience) claim against the expected client_id. Although Oxia implemented a custom audience check in Authenticate(), disabling the standard library-level check is the root cause - a classic CWE-287 (Improper Authentication) failure where a built-in security control is turned off and the compensating logic fails to fully enforce it. The OIDC aud claim is precisely the mechanism that scopes a token to one relying party; with its enforcement disabled, any token minted by the shared issuer (regardless of intended client_id) that passes signature, issuer, and expiry checks is accepted. Affected product per CPE: cpe:2.3:a:oxia-db:oxia:*.
RemediationAI
Upgrade to Oxia 0.16.2 or later, which fixes the flaw by removing SkipClientIDCheck: true and setting the ClientID field from the configured AllowedAudiences so go-oidc enforces the aud claim (Vendor-released patch: 0.16.2; see GHSA-fhvp-9hcj-6m33). If you cannot upgrade immediately, apply the vendor-recommended workaround of enforcing network-level isolation so only trusted services can reach the Oxia gRPC endpoints - for example restrict the gRPC listener to a private network segment and apply firewall/security-group rules or a service-mesh mTLS policy limiting which clients can connect. The trade-off is that network isolation only reduces reachability and does not restore audience validation, so any trusted service or foothold inside the allowed segment that can obtain a same-issuer token still bypasses audience isolation; treat it strictly as a stopgap until 0.16.2 is deployed. Where feasible, also scope or rotate the OIDC issuer/client configuration so Oxia does not share an issuer with unrelated services.
Sensitive information disclosure in Oxia (a metadata store and coordination system) prior to 0.16.2 causes the full OIDC
Denial-of-service in Oxia (metadata store and coordination system) versions <= 0.16.1 allows a remote unauthenticated cl
Incomplete PEM parsing in Oxia's TLS subsystem silently drops all but the first certificate from CA bundle files, breaki
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today