VulnSocial

CVE-2026-82454Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-347

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-08-29); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-08-29: 1Mentions · 2026-08-30: 1Patch / Workaround · 2026-08-29: 1Technical Details · 2026-08-29: 1Technical Details · 2026-08-30: 108-2908-30
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-08-291
Disclosure1
2026-08-301
General1
Full discourse2 posts
  • NewNormal Security@NewScanTeam
    General

    NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 30 Aug 2026 𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan: 🔓 MCP server that authenticates no caller — drive every tool the agent exposes, anonymously (argocd-mcp CVE-2026-82456) 🔑 JWT accepted without checking its signature — forge a token for any user (Omnivore CVE-2026-82454) 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🔀 SSRF allow-list that forgets carrier-grade NAT — reach the cloud metadata service the guard was written to block (Memos CVE-2026-82476) 📦 WordPress SSO plugin with an authentication bypass — sign in as any account, no password (miniOrange SAML Single Sign On CVE-2026-75807) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #SSRF #CSO #REDTEAM

    Post summary

    A daily CVE roundup that lists several newly covered vulnerabilities with brief technical descriptions, but without evidence of exploitation or remediation guidance.

    1001084
    7 followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    🚨 CRITICAL — CVE-2026-82454 The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in tok… CVSS 9.1 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-82454 #Apple #CyberSecurity #InfoSec

    Post summary

    Critical authentication bypass CVE-2026-82454 disclosed with high CVSS, no patch available yet.

    0000056
    80 followersView on X

Explore more

Back to dashboard