Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

openfga — Vulnerabilities & Security Advisories 26

All 26 CVE vulnerabilities found in openfga, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known vulnerability records for openfga, a fine-grained access control system, categorized under various weakness types and tagged for reference. It collects security advisories, bug reports, and exploit disclosures affecting the openfga software ecosystem, covering data from its initial public release through the current date to ensure comprehensive historical context. Readers can track official vendor advisories to stay informed about critical patches and recommended mitigations, understand the nature and impact of specific weakness classes prevalent in this type of authorization service, and look up a product's complete vulnerability history to assess long-term security posture and risk trends over time. The information presented is derived from public sources, including GitHub issues, CVE databases, and security mailing lists, providing a neutral and factual overview of identified flaws. This resource is designed to assist developers, security analysts, and system administrators in evaluating the integrity of their deployments of openfga. By consolidating disparate reports into a single accessible view, users can quickly identify potential threats, compare severity levels, and prioritize remediation efforts based on verified data rather than fragmented notifications. The page does not include unverified claims or speculative risks, focusing strictly on documented and acknowledged security issues. Regular updates ensure that the latest developments are reflected promptly, supporting proactive defense strategies and informed decision-making regarding software updates and configuration changes.

Vendor: openfga

CVE IDTitleCVSSSeverityPublished
CVE-2026-55689 OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset CWE-287 6.8 Medium2026-07-09
CVE-2026-55170 OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions CWE-178--2026-07-09
CVE-2026-48096 OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning CWE-345 5.0 Medium2026-06-10
CVE-2026-41131 OpenFGA has Improper Policy Enforcement CWE-863 5.0 Medium2026-04-21
CVE-2026-40293 OpenFGA Playground Preshared Key Exposure CWE-200 6.5 Medium2026-04-17
CVE-2026-34972 OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision CWE-863 5.0 Medium2026-04-06
CVE-2026-33729 OpenFGA has an Authorization Bypass through cached keys CWE-20 3.7 -2026-03-27
CVE-2026-24851 OpenFGA Improper Policy Enforcement CWE-863 9.8AICriticalAI2026-02-06
CVE-2025-64751 OpenFGA Improper Policy Enforcement CWE-285 9.8 -2025-11-21
CVE-2025-55213 OpenFGA Authorization Bypass (Check) CWE-863 9.8 -2025-08-18
CVE-2025-48371 OpenFGA Authorization Bypass CWE-285 9.8AICriticalAI2025-05-22
CVE-2025-46331 OpenFGA Authorization Bypass CWE-284 9.8AICriticalAI2025-04-30
CVE-2025-25196 OpenFGA Authorization Bypass CWE-285 8.1 -2025-02-19
CVE-2024-56323 OpenFGA Authorization Bypass CWE-285 9.8 -2025-01-13
CVE-2024-42473 OpenFGA Authorization Bypass CWE-863 7.5 High2024-08-09
CVE-2024-31452 OpenFGA Authorization Bypass CWE-863 8.1 High2024-04-16
CVE-2024-23820 OpenFGA DoS CWE-770 5.3 Medium2024-01-26
CVE-2023-45810 OpenFGA denial of service CWE-400 5.3 Medium2023-10-17
CVE-2023-43645 Denial of service from circular relationship definitions in OpenFGA CWE-835 5.9 Medium2023-09-26
CVE-2023-40579 OpenFGA Authorization Bypass CWE-284 6.5 Medium2023-08-25
CVE-2023-35933 OpenFGA denial of service die to circular relationship CWE-835 5.9 Medium2023-06-26
CVE-2022-23542 OpenFGA Authorization Bypass CWE-285 7.7 High2022-12-20
CVE-2022-39352 OpenFGA Authorization Bypass CWE-863 4.8 Medium2022-11-08
CVE-2022-39342 OpenFGA Authorization Bypass CWE-285 5.9 Medium2022-10-25
CVE-2022-39341 OpenFGA Authorization Bypass CWE-285 5.9 Medium2022-10-25
CVE-2022-39340 OpenFGA Information Disclosure CWE-285 5.3 Medium2022-10-25

All 26 known CVE vulnerabilities affecting openfga with full Chinese analysis, references, and POCs where available.