OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC
    authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was
    configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the
    same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0. (CVE-2026-55689)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC     authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was     configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the     same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0. (CVE-2026-55689)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
465753	Echo: grafana-12.3-fips: security update to 12.3.11+e4	Tenable Cloud Security	Echo Local Security Checks	Local	high
465753	Echo: grafana-12.3-fips: security update to 12.3.11+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
326293	Linux Distros Unpatched Vulnerability : CVE-2026-55689	Nessus	Misc.	Local	high
443601	SCA: security update for github.com/openfga/openfga (GHSA-hcxc-wf8j-23hv)	Tenable Cloud Security	SCA Checks	Local	high
443601	SCA: security update for github.com/openfga/openfga (GHSA-hcxc-wf8j-23hv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-55689

high

Tenable Plugins

high

high

high

high

high