EXPOSURES › CVE-2026-82454
CVE-2026-82454
CRITICALAn authentication bypass in the Omnivore API allowed attackers to forge Apple sign-in tokens and impersonate any Apple-linked account.
The vulnerability stemmed from improper JWT algorithm validation, enabling attackers to bypass Apple sign-in verification and impersonate users. DIB organizations must ensure strict JWT algorithm validation and avoid relying on unvalidated cryptographic assumptions, as this flaw directly compromises identity and access management—a critical control under NIST 800-171. Organizations should audit their JWT implementations and enforce algorithm compatibility checks to prevent similar token forgery attacks.
Shame score — The flaw allowed complete authentication bypass via token forgery, exposing user identities and enabling unauthorized access without requiring a patch to exist beforehand.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.