CVE-2026-82454 omnivore-app CVE debrief

Who should care

Omnivore API administrators, developers, and users; Apple-linked account holders; security teams monitoring authentication and token verification vulnerabilities; operators and platforms using Omnivore API; vulnerability management and security teams responsible for patching and mitigation.

Technical summary

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8, an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account. Affected product context indicates potential impact on authentication and token verification processes.

Defensive priority

Critical vulnerability in Omnivore API authentication bypass via Apple sign-in token verification.

Recommended defensive actions

• Verify and apply vendor patch in commit abf53d6 or later
• Implement compensating controls for authentication and token verification
• Monitor for suspicious Apple sign-in token activity
• Inventory and audit Omnivore API deployments for vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. Evidence is limited; verify with vendor and public records. Limited source detail available; defenders should verify affected scope, severity, and vendor guidance with caution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.