Summary
CVE-2026-82454 is a critical authentication bypass vulnerability in the Omnivore API’s Apple Sign-in token verification, caused by improper verification of a cryptographic signature (CWE-347). The decodeAppleToken function trusted the alg value supplied in an attacker-controlled JWT header when calling jwt.verify(), allowing an attacker to forge valid-looking tokens and impersonate any Apple-linked Omnivore account. The flaw carries a CVSS v3.1 base score of 9.1 (CVSS v4.0: 9.3), both rated Critical.
Technical details
- Root cause: The
decodeAppleTokenfunction read thealgfield directly from the JWT header supplied by the client and passed it as the algorithm to use forjwt.verify(), rather than enforcing a fixed, expected algorithm (e.g., RS256). - Trigger conditions: Apple’s RSA public signing keys are publicly published via Apple’s JWKS endpoint. An attacker crafts a JWT header declaring
alg: HS256and signs the token using Apple’s public RSA key as the HMAC secret. Because the underlyingjsonwebtokenlibrary version in use did not validate that the key type matched the declared algorithm, the forged HMAC signature validated successfully against the RSA key material. - Attack vector: Network — no authentication or user interaction required; the attacker only needs to send a crafted sign-in request to the exposed Omnivore API.
- Impact: Full authentication bypass, allowing an attacker to impersonate any Apple-linked Omnivore account and access that account’s data (confidentiality and integrity impact; no availability impact per the CVSS vector).
Affected software
- Omnivore API (
omnivore-app/packages/api) — all versions/commits prior to fix commitabf53d6508755d3d22a994e28e370a9193ea977a, corresponding to releases before android-0.227.0.
Severity
- CVSS v3.1 Base Score: 9.1 (Critical) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS v4.0 Score: 9.3 (Critical) —
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: Update to the patched code at or after commit
abf53d6508755d3d22a994e28e370a9193ea977a(corresponding to android-0.227.0 and later), which removes reliance on the client-suppliedalgheader value. - If unable to patch immediately: Enforce a hardcoded, expected signing algorithm (RS256) when verifying Apple Sign-in JWTs, reject any token whose header algorithm does not match, and upgrade the
jsonwebtokendependency to a version that validates key/algorithm type compatibility. Note that Omnivore’s original hosted SaaS service has been shut down; this issue applies to self-hosted or forked deployments of the open-source codebase that still expose the Apple Sign-in API.

