OP
Product
openfga
27
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 7Medium 9Low 0
Watch
Add openfga to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33729 | 9.8 | Mar 27 | OpenFGA has an Authorization Bypass through cached keys Affected: < 1.13.1 |
| CVE-2025-55213 | 9.8 | Aug 18 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar Affected: 1.9.3 before 1.9.5 |
| CVE-2025-46331 | 9.8 | Apr 30 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar Affected: 1.3.6 before 1.8.11 |
| CVE-2025-25196 | 9.8 | Feb 19 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar Affected: before 1.8.5 |
| CVE-2024-56323 | 9.8 | Jan 13 | OpenFGA is an authorization/permission engine Affected: 1.3.8 before 1.8.3 |
| CVE-2024-42473 | 9.8 | Aug 12 | OpenFGA is an authorization/permission engine Affected: 1.5.7; 1.5.8 |
| CVE-2024-31452 | 9.8 | Apr 16 | OpenFGA is a high-performance and flexible authorization/permission engine Affected: 1.5.0 before 1.5.3 |
| CVE-2022-23542 | 9.8 | Dec 20 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar Affected: before 0.3.1 |
| CVE-2022-39352 | 9.8 | Nov 8 | OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar Affected: before 0.2.5 |
| CVE-2022-39342 | 9.8 | Oct 25 | OpenFGA Authorization Bypass Affected: < 0.2.4 |
| CVE-2022-39341 | 9.8 | Oct 25 | OpenFGA Authorization Bypass Affected: < 0.2.4 |
| CVE-2026-34972 | 8.8 | Apr 6 | OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision Affected: >= 1.8.0, < 1.14.0 |
| CVE-2026-24851 | 8.8 | Feb 6 | OpenFGA Improper Policy Enforcement Affected: < 1.11.3 |
| CVE-2025-64751 | 8.8 | Nov 21 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar Affected: 1.4.0 before 1.11.1 |
| CVE-2025-48371 | 8.8 | May 22 | OpenFGA is an authorization/permission engine Affected: 1.8.0 before 1.8.13 |
| CVE-2026-55689 | 8.1 | Jul 9 | OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset Affected: < 1.18.0 |
| CVE-2023-45810 | 7.5 | Oct 17 | OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar Affected: before 1.3.4 |
| CVE-2023-35933 | 7.5 | Jun 26 | OPenFGA is an open source authorization/permission engine built for developers Affected: before 1.1.1 |
| CVE-2026-40293 | 6.5 | Apr 17 | OpenFGA Playground Preshared Key Exposure Affected: >= 0.1.4, < 1.14.0 |
| CVE-2024-23820 | 6.5 | Jan 26 | OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3 Affected: before 1.4.3 |
| CVE-2023-40579 | 6.5 | Aug 25 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar Affected: before 1.3.1 |
| CVE-2023-43645 | 5.9 | Sep 27 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar Affected: before 1.3.2 |
| CVE-2026-55170 | 5.4 | Jul 9 | OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions Affected: < 1.18.0 |
| CVE-2026-61709 | 5.3 | Sep 16 | OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user Affected: < 1.18.1 |
| CVE-2026-48096 | 5.3 | Jun 10 | OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning Affected: < 1.16.0 |
| CVE-2022-39340 | 5.3 | Oct 25 | OpenFGA Information Disclosure Affected: < 0.2.4 |
| CVE-2026-41131 | 5.0 | Apr 21 | OpenFGA has Improper Policy Enforcement Affected: < 1.14.1 |
Showing 27