Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Omnivore API allows fake Apple sign‑in tokens

CVE-2026-82454 · published 5 days ago
Summary

The Omnivore web service could be tricked into accepting a forged Apple login token, letting an attacker appear as any Apple‑linked user. This happens because the code used the token’s own settings to verify its signature, which can be manipulated. Update the software to the latest version that corrects this verification logic.

What to do
  • Update omnivore-app omnivore to version abf53d650875 or later.
Affected software
VendorProductAffected versions
omnivore-app omnivore < abf53d650875
Original advisory text
Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.
References
Severity
9.3 Critical
CVSS 3.1: 9.1 (MITRE)
Exploitation
EPSS <1%
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published29 Aug 2026
Updated2 Sep 2026
First seen29 Aug 2026
Sources
CVE-2026-82454 · NVD
CVE-2026-82454 · MITRE
Monitor software like this
Free during beta