Submit #1004924: minio minio RELEASE.2025-10-15T17-29-55Z Improper Verification of Cryptographic Signature

When MinIO is configured with an OIDC identity provider using a Public Client (OAuth 2.0 public client type, where client_secret is empty), the function PopulatePublicKey() stores []byte("") as an HMAC signing key in the public key map, keyed by the client_id.

The JWT validation function Validate() includes HS256, HS384, and HS512 in its ValidMethods list. An attacker who knows the client_id can forge a JWT with alg: HS256 and kid: <client_id>, signed using the empty byte slice as the HMAC key. MinIO accepts this forged JWT at the unauthenticated AssumeRoleWithWebIdentity STS endpoint and issues valid temporary AWS credentials.

The attacker controls all JWT claims including the policy claim, allowing them to assume any IAM policy (e.g., consoleAdmin) and gain full read/write access to all S3 data.

• Source: ⚠️ https://github.com/zast-ai/vulnerability-reports/blob/main/minio/jwt_forgery.md
• User: ZAST.AI (UID 87884)
• Submission: 09/29/2026 11:24 (26 days ago)
• Moderation: 10/20/2026 10:04 (21 days later)
• Status: Duplicate
• VulDB entry: 351748 [MinIO JWT improper authentication]
• Points: 0