Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia. This vulnerability is fixed in 0.16.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
CVE-2026-40946 Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifi… https://www.cve.org/CVERecord?id=CVE-2026-40946
Post summary
The text reports a new vulnerability (CVE‑2026‑40946) in Oxia’s OIDC provider that unconditionally allows SkipClientIDCheck: true, enabling potential authentication bypass.
🚨 CVE-2026-40946: Oxia: OIDC token audience valida... Hardcoded SkipClientIDCheck bypasses OIDC audience validation - any JWT from the same issuer grants full access regardl... https://zerodaysignal.com/vulnerability/CVE-2026-40946 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE-2026-40946, a hardcoded SkipClientIDCheck bypass in Oxia’s OIDC token audience validation, and links to a resource that likely contains a PoC, but no exploit code or patch is mentioned.