THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-82454 (CRITICAL 9.1) — The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt

[NVD] CVE-2026-82454 (CRITICAL 9.1) — The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt

mednvdPublished 2026-08-29

CVE-2026-82454 CVSS: 9.1 CRITICAL Published: 2026-08-29T14:16:38.480

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not v

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82454