CVE-2026-40946: Oxia Auth Bypass Vulnerability

CVE-2026-40946 Overview

CVE-2026-40946 is a critical authentication bypass vulnerability in Oxia, a metadata store and coordination system. Prior to version 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This misconfiguration allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia, enabling unauthorized access to the system.

Critical Impact

Attackers with valid tokens from any service using the same OIDC provider can bypass authentication and gain unauthorized access to Oxia metadata stores, potentially compromising sensitive coordination data and metadata.

Affected Products

• Oxia versions prior to 0.16.2
• Systems using OIDC authentication with Oxia
• Environments sharing OIDC issuers across multiple services

Discovery Timeline

• April 21, 2026 - CVE-2026-40946 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40946

Vulnerability Analysis

This vulnerability stems from improper authentication configuration in Oxia's OIDC implementation. The OIDC (OpenID Connect) protocol relies on token validation to ensure that authentication tokens are legitimate and intended for the specific application requesting access. A critical component of this validation is the audience (aud) claim check, which verifies that the token was issued specifically for the consuming application.

In vulnerable versions of Oxia, the OIDC verifier configuration explicitly disables this audience validation by setting SkipClientIDCheck: true. This means the system accepts any valid token from the configured OIDC issuer, regardless of the intended audience. An attacker who possesses a legitimate token issued by the same OIDC provider for a completely different application can use that token to authenticate to Oxia.

The impact of this vulnerability is significant in environments where multiple services share a common OIDC provider. An attacker with access to any token from any application within the same identity ecosystem can pivot to gain unauthorized access to Oxia's metadata store and coordination services.

Root Cause

The root cause is improper authentication validation in the go-oidc verifier configuration. The SkipClientIDCheck: true setting was unconditionally applied, removing a critical security control that prevents cross-service token abuse. This represents a violation of the principle of least privilege, as tokens should only be accepted when explicitly issued for the requesting application.

Attack Vector

The attack requires network access to the Oxia service endpoint. An attacker needs to obtain a valid OIDC token from any service that shares the same OIDC issuer as Oxia. This token could be obtained through legitimate access to another application, token leakage, or other means. Once in possession of such a token, the attacker presents it to Oxia's authentication endpoint. Because audience validation is disabled, Oxia accepts the token and grants access despite the token being intended for a different service.

The vulnerability requires no authentication complexity bypass since the authentication mechanism itself is fundamentally misconfigured. The attacker exploits the trust relationship established between Oxia and the OIDC provider without needing to compromise Oxia directly.

Detection Methods for CVE-2026-40946

Indicators of Compromise

• Unexpected authentication events from tokens with mismatched aud claims in Oxia access logs
• Access patterns from user identities that do not have legitimate Oxia application credentials
• Authentication tokens being used across multiple services with different expected audiences
• Anomalous metadata access or coordination system modifications from unauthorized sources

Detection Strategies

• Implement logging of the aud claim in all authentication events and alert on mismatches with the expected Oxia client ID
• Deploy token inspection at the application layer to validate audience claims independently of the OIDC library
• Monitor for authentication patterns where users successfully authenticate to Oxia but lack corresponding application-level permissions
• Correlate authentication logs across services sharing the same OIDC provider to detect token reuse across applications

Monitoring Recommendations

• Enable detailed authentication logging in Oxia to capture full token claims including the aud field
• Configure SIEM rules to alert on authentication events where the audience claim does not match expected values
• Implement real-time monitoring of Oxia metadata access patterns to detect unauthorized operations
• Review OIDC token usage across all applications sharing the same identity provider for signs of cross-application token abuse

How to Mitigate CVE-2026-40946

Immediate Actions Required

• Upgrade Oxia to version 0.16.2 or later immediately to enable proper audience validation
• Audit authentication logs for signs of unauthorized access using tokens from other applications
• Review all OIDC-authenticated sessions and revoke any suspicious tokens
• Implement network segmentation to limit exposure of Oxia services while patching is completed

Patch Information

The vulnerability is fixed in Oxia version 0.16.2. The patch enables proper audience claim validation in the OIDC verifier configuration, ensuring that only tokens explicitly issued for Oxia are accepted. Organizations should upgrade to this version or later to remediate the vulnerability.

For additional details, refer to the GitHub Security Advisory.

Workarounds

• Deploy an API gateway or reverse proxy in front of Oxia that performs independent audience claim validation before forwarding requests
• Implement a custom authentication middleware that validates the aud claim matches the expected Oxia client ID
• Restrict network access to Oxia services using firewall rules or network policies to limit exposure while awaiting patch deployment
• Consider temporarily disabling OIDC authentication and using alternative authentication mechanisms until the upgrade is complete

# Example: Upgrading Oxia to patched version
# Verify current version
oxia version

# Upgrade to fixed version 0.16.2 or later
# Using go install
go install github.com/oxia-db/oxia@v0.16.2

# Verify the upgrade
oxia version
# Expected output: v0.16.2 or later