Security Advisories for github.com/openfga/openfga in go
Moderate
27 days ago
OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user
go
github.com/openfga/openfga
Moderate
4 months ago
OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
go
github.com/openfga/openfga
Moderate
4 months ago
OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning
go
github.com/openfga/openfga
Moderate
6 months ago
OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response
go
github.com/openfga/openfga
Moderate
6 months ago
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision
go
github.com/openfga/openfga
Moderate
7 months ago
OpenFGA has an Authorization Bypass through cached keys
go
github.com/openfga/openfga
Moderate
about 3 years ago
OpenFGA Vulnerable to DoS from circular relationship definitions
go
github.com/openfga/openfga
Moderate
over 3 years ago
OpenFGA vulnerable to denial of service due to circular relationship
go
github.com/openfga/openfga
Moderate
almost 4 years ago
OpenFGA Authorization Bypass via tupleset wildcard
go
github.com/openfga/openfga
Moderate
almost 4 years ago
OpenFGA subject to Information Disclosure via streamed-list-objects endpoint
go
github.com/openfga/openfga