Openfga vulnerabilities
27 CVEs and advisories name Openfga as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-61709OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user
- CVE-2026-55689OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
- CVE-2026-55170OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions
- CVE-2026-48096OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning
- CVE-2026-41131OpenFGA has Improper Policy Enforcement
- CVE-2026-40293OpenFGA Playground Preshared Key Exposure
- CVE-2026-34972OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision
- CVE-2026-33729OpenFGA has an Authorization Bypass through cached keys
- CVE-2026-24851OpenFGA Improper Policy Enforcement
- CVE-2025-64751OpenFGA Improper Policy Enforcement
- CVE-2025-55213OpenFGA Authorization Bypass (Check)
- CVE-2025-48371OpenFGA Authorization Bypass
- CVE-2025-46331OpenFGA Authorization Bypass
- CVE-2025-25196OpenFGA Authorization Bypass
- CVE-2024-56323OpenFGA Authorization Bypass
- CVE-2024-42473OpenFGA Authorization Bypass
- CVE-2024-31452OpenFGA Authorization Bypass
- CVE-2024-23820OpenFGA DoS
- CVE-2023-45810OpenFGA denial of service
- CVE-2023-43645Denial of service from circular relationship definitions in OpenFGA
- CVE-2023-40579OpenFGA Authorization Bypass
- CVE-2023-35933OpenFGA denial of service die to circular relationship
- CVE-2022-23542OpenFGA Authorization Bypass
- CVE-2022-39352OpenFGA Authorization Bypass
- CVE-2022-39342OpenFGA Authorization Bypass
- CVE-2022-39341OpenFGA Authorization Bypass
- CVE-2022-39340OpenFGA Information Disclosure