Omnivore API Authentication Bypass via JWT Algorithm Confusion

The Omnivore API, specifically within the packages/api module, contains a critical authentication bypass vulnerability (CVE-2026-82454) arising from insecure JSON Web Token (JWT) verification. The vulnerability exists within the decodeAppleToken function, which extracts the 'alg' header field from an attacker-supplied token and passes it directly to the verification function. Because the implementation uses an outdated version of the jsonwebtoken library (v8), it fails to enforce strict key and algorithm compatibility. An attacker can craft a forged JWT by setting the 'alg' field to 'HS256' and using the publicly available Apple RSA public key as the HMAC shared secret. This allows the attacker to successfully authenticate as any user registered via Apple Sign-in, potentially leading to full account takeover. The issue is resolved in commit abf53d6.

Impact

Successful exploitation allows unauthenticated attackers to impersonate any user currently using the Apple sign-in method within the Omnivore ecosystem. This leads to complete unauthorized access to victim accounts, enabling the exfiltration of personal data, account settings modification, and further malicious activity. The vulnerability carries a CVSS v3.1 base score of 9.1, indicating a high risk to availability, integrity, and confidentiality of user accounts.

Recommendation

1. Upgrade the Omnivore API deployment to a version incorporating the fix identified in commit abf53d6 or later.
2. Perform an audit of application authentication logs for anomalous Apple Sign-in traffic, specifically looking for tokens where the header 'alg' field does not match the expected 'RS256' algorithm.
3. Validate if the environment is utilizing vulnerable versions of the jsonwebtoken library and update to a version that enforces strict algorithm-to-key matching (e.g., jsonwebtoken v9 or newer).