Auth bypass in Oxia-db Oxia

CVE-2026-40946

Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation…

Vulnerability class: Broken Authentication

EPSS: 0.001 (21.1th percentile) — read the EPSS interpretation.