openfga vulnerabilities

CVEs per yearBy the year they were published

1. 20225
2. 20234
3. 20243
4. 20256
5. 20269

Newest CVEs

• CVE-2026-61709

  OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

  openfga · openfga

  Medium5.3
• CVE-2026-55689

  OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset

  openfga · openfga

  Medium6.8
• CVE-2026-55170

  OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

  openfga · openfga

  Low2.1
• CVE-2026-48096

  OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning

  openfga · openfga

  Medium5.0
• CVE-2026-41131

  OpenFGA has Improper Policy Enforcement

  openfga · openfga

  Medium5.0
• CVE-2026-40293

  OpenFGA Playground Preshared Key Exposure

  openfga · openfga

  Medium6.5
• CVE-2026-34972

  OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision

  openfga · openfga

  Medium5.0
• CVE-2026-33729

  OpenFGA has an Authorization Bypass through cached keys

  openfga · openfga

  Medium5.8
• CVE-2026-24851

  OpenFGA Improper Policy Enforcement

  openfga · openfga

  Medium5.8
• CVE-2025-64751

  OpenFGA Improper Policy Enforcement

  openfga · openfga

  Medium5.8