CVE-2026-82454

CVE-2026-82454 is a critical (CVSS 4.0 9.3) authentication bypass (CWE-347) in the Apple sign-in token verification of the Omnivore API (packages/api), the backend of the open-source Omnivore read-it-later application. The decodeAppleToken function read the attacker-supplied 'alg' field from the JWT header and passed it to jwt.verify() as the only allowed algorithm, and because the code used jsonwebtoken v8, which does not check that the signing key type matches the algorithm, an attacker could forge a token with alg=HS256 whose HMAC signature is computed using Apple's publicly available RSA public key as the secret. A forged token is then accepted as a valid Apple identity, letting an unauthenticated, network-located attacker impersonate any Apple-linked account on deployments built before commit abf53d6 that have Sign in with Apple enabled, with no privileges or user interaction required. Exploitation is not currently observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates roughly a 0.2% chance of exploitation within 30 days (14th percentile).

What to do: Update the Omnivore API to source containing commit abf53d6 or later (the available data lists no tagged release) and, where feasible, move the jsonwebtoken dependency beyond v8, which enforces key/algorithm compatibility. Until patched, disable Sign in with Apple on affected deployments or monitor authentication logs for Apple-issuer tokens accepted with an HMAC algorithm, which would indicate forged-token logins; deployments that do not use Apple sign-in are not exposed to this bypass.