CVE-2023-23612

OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are processed from the JWTs where the leading and trailing whitespace is trimmed, allowing users to potentially claim roles they are not assigned to if any role matches the whitespace-stripped version of the roles they are a member of. This issue is only present for authenticated users, and it requires either the existence of roles that match, not considering leading/trailing whitespace, or the ability for users to create said matching roles. In addition, the Identity Provider must allow leading and trailing spaces in role names. OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1 are affected. Users are advised to upgrade to OpenSearch 1.3.8 or 2.5.0. There are no known workarounds for this issue.

• CWE-287
• CWE-287

• https://github.com/opensearch-project/OpenSearch/releases/tag/2.5.0Third Party Advisory
• https://github.com/opensearch-project/security/security/advisories/GHSA-864v-6qj7-62qjThird Party Advisory
• https://github.com/opensearch-project/OpenSearch/releases/tag/2.5.0Third Party Advisory
• https://github.com/opensearch-project/security/security/advisories/GHSA-864v-6qj7-62qjThird Party Advisory

Published

Jan 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23607erohtar/Dasherr is a dashboard for self-hosted services. In …9.8
• CVE-2023-23608Spotipy is a light weight Python library for the Spotify Web…4.3
• CVE-2023-23609Contiki-NG is an open-source, cross-platform operating syste…7.4
• CVE-2023-2361Cross-site Scripting (XSS) - Stored in GitHub repository pim…5.4
• CVE-2023-23610GLPI is a Free Asset and IT Management Software package. Ver…6.5
• CVE-2023-23611LTI Consumer XBlock implements the consumer side of the LTI …5.4
• CVE-2023-23613OpenSearch is an open source distributed and RESTful search …6.5
• CVE-2023-23614Pi-hole®'s Web interface (based off of AdminLTE) provides a …8.8
• CVE-2023-23615Discourse is an open source discussion platform. The embedda…5.3
• CVE-2023-23616Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2023-23617OpenMage LTS is an e-commerce platform. Versions prior to 19…7.5
• CVE-2023-23618Git for Windows is the Windows port of the revision control …7.8