CVE-2026-40946

Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia. This vulnerability is fixed in 0.16.2.

• CWE-287

• https://github.com/oxia-db/oxia/security/advisories/GHSA-fhvp-9hcj-6m33

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4094The FOX – Currency Switcher Professional for WooCommerce plu…8.1
• CVE-2026-40941Cacti is an open source performance and fault management fra…6.5
• CVE-2026-40942The Data Sharing Framework (DSF) implements a distributed pr…6.3
• CVE-2026-40943Oxia is a metadata store and coordination system. Prior to 0…8.7
• CVE-2026-40944Oxia is a metadata store and coordination system. Prior to 0…6.9
• CVE-2026-40945Oxia is a metadata store and coordination system. Prior to 0…8.7
• CVE-2026-40947Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, an…2.9
• CVE-2026-40948The Keycloak authentication manager in `apache-airflow-provi…5.4
• CVE-2026-40949CVE-2026-40949 is a buffer overflow vulnerability in the Sec…4.4
• CVE-2026-40950CVE-2026-40950 is a buffer overflow vulnerability in the Sec…6.5
• CVE-2026-40951CVE-2026-40951 is a memory corruption vulnerability on Secur…5.5
• CVE-2026-40952CVE-2026-40952 is a privilege misconfiguration in the Secure…7.8