# cve.now: Openfga

The newest entries naming Openfga as an affected vendor (up to 200), of 27 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-61709](https://cve.now/CVE-2026-61709.md): OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a \`but not\` exclusion under a type-bound wildcard is intersected (\`and\`) with another relation that also grants that user (CVSS 5.3)
- [CVE-2026-55689](https://cve.now/CVE-2026-55689.md): OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset (CVSS 6.8)
- [CVE-2026-55170](https://cve.now/CVE-2026-55170.md): OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions (CVSS 2.1)
- [CVE-2026-48096](https://cve.now/CVE-2026-48096.md): OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning (CVSS 5.0)
- [CVE-2026-41131](https://cve.now/CVE-2026-41131.md): OpenFGA has Improper Policy Enforcement (CVSS 5.0)
- [CVE-2026-40293](https://cve.now/CVE-2026-40293.md): OpenFGA Playground Preshared Key Exposure (CVSS 6.5)
- [CVE-2026-34972](https://cve.now/CVE-2026-34972.md): OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision (CVSS 5.0)
- [CVE-2026-33729](https://cve.now/CVE-2026-33729.md): OpenFGA has an Authorization Bypass through cached keys (CVSS 5.8)
- [CVE-2026-24851](https://cve.now/CVE-2026-24851.md): OpenFGA Improper Policy Enforcement (CVSS 5.8)
- [CVE-2025-64751](https://cve.now/CVE-2025-64751.md): OpenFGA Improper Policy Enforcement (CVSS 5.8)
- [CVE-2025-55213](https://cve.now/CVE-2025-55213.md): OpenFGA Authorization Bypass (Check) (CVSS 5.8)
- [CVE-2025-48371](https://cve.now/CVE-2025-48371.md): OpenFGA Authorization Bypass (CVSS 5.8)
- [CVE-2025-46331](https://cve.now/CVE-2025-46331.md): OpenFGA Authorization Bypass (CVSS 5.8)
- [CVE-2025-25196](https://cve.now/CVE-2025-25196.md): OpenFGA Authorization Bypass (CVSS 5.8)
- [CVE-2024-56323](https://cve.now/CVE-2024-56323.md): OpenFGA Authorization Bypass (CVSS 5.8)
- [CVE-2024-42473](https://cve.now/CVE-2024-42473.md): OpenFGA Authorization Bypass (CVSS 7.5)
- [CVE-2024-31452](https://cve.now/CVE-2024-31452.md): OpenFGA Authorization Bypass (CVSS 8.1)
- [CVE-2024-23820](https://cve.now/CVE-2024-23820.md): OpenFGA DoS (CVSS 5.3)
- [CVE-2023-45810](https://cve.now/CVE-2023-45810.md): OpenFGA denial of service (CVSS 5.3)
- [CVE-2023-43645](https://cve.now/CVE-2023-43645.md): Denial of service from circular relationship definitions in OpenFGA (CVSS 5.9)
- [CVE-2023-40579](https://cve.now/CVE-2023-40579.md): OpenFGA Authorization Bypass (CVSS 6.5)
- [CVE-2023-35933](https://cve.now/CVE-2023-35933.md): OpenFGA denial of service die to circular relationship (CVSS 5.9)
- [CVE-2022-23542](https://cve.now/CVE-2022-23542.md): OpenFGA Authorization Bypass (CVSS 7.7)
- [CVE-2022-39352](https://cve.now/CVE-2022-39352.md): OpenFGA Authorization Bypass (CVSS 4.8)
- [CVE-2022-39342](https://cve.now/CVE-2022-39342.md): OpenFGA Authorization Bypass (CVSS 5.9)
- [CVE-2022-39341](https://cve.now/CVE-2022-39341.md): OpenFGA Authorization Bypass (CVSS 5.9)
- [CVE-2022-39340](https://cve.now/CVE-2022-39340.md): OpenFGA Information Disclosure (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/openfga
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.