CVE-2026-40946 Oxia: OIDC token audience validation bypass via SkipClientIDCheck
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-40946?
CVE-2026-40946 is a critical vulnerability in oxia-db oxia, published on 21 Apr 2026.
Official description
Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia. This vulnerability is fixed in 0.16.2.
Weakness: CWE-287
Which versions are affected by CVE-2026-40946?
3 open source packages ship an affected version, including github.com/oxia-db/oxia.
| Package | Affected | Fixed in |
|---|---|---|
github.com/oxia-db/oxia Go | All versions | 0.16.2 |
github.com/oxia-db/oxia Go | All versions | 0.16.2 |
github.com/oxia-db/oxia Go | All versions | 0.16.2 |
How do I fix CVE-2026-40946?
Upgrade github.com/oxia-db/oxia to 0.16.2 or later.
Is CVE-2026-40946 being exploited?
There is no known exploitation of CVE-2026-40946 in the wild and no public exploit code.
Sources
Also known as GHSA-fhvp-9hcj-6m33, GO-2026-5364.