CVE-2026-82454: Omnivore-App Omnivore

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.

Affected products

• Omnivore-App Omnivore

Published 2026-08-29. Last modified 2026-09-24.