omnivore-app Omnivore Apple Sign-In Token Verification packages/api decodeAppleToken alg signature verification

Summaryinfo

A vulnerability was found in omnivore-app Omnivore. It has been rated as critical. The impacted element is the function decodeAppleToken of the file packages/api of the component Apple Sign-In Token Verification. The manipulation of the argument alg leads to signature verification. This vulnerability is traded as CVE-2026-82454. It is possible to initiate the attack remotely. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability, which was classified as critical, has been found in omnivore-app Omnivore (version unknown). This issue affects the function decodeAppleToken of the file packages/api of the component Apple Sign-In Token Verification. The manipulation of the argument alg with an unknown input leads to a signature verification vulnerability. Using CWE to declare the problem leads to CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-82454 since 08/29/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Applying the patch abf53d650875 is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• omnivore-app

Name

• Omnivore

Website

• Product: https://github.com/omnivore-app/omnivore/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion