CVE-2026-82454

Name of the Vulnerable Software and Affected Versions Omnivore API (packages/api) versions prior to commit abf53d6

Description An authentication bypass exists in the Apple sign-in token verification process. The decodeAppleToken() function extracts the alg field from the JWT header provided by the user and passes it as the only permitted algorithm to jwt.verify(). When using jsonwebtoken v8, which lacks key and algorithm compatibility validation, an attacker can set alg to HS256 and sign a forged token using Apple's public RSA key as the HMAC secret. This allows the attacker to bypass signature verification and impersonate any account linked to Apple.

Recommendations Update Omnivore API (packages/api) to the version containing commit abf53d6.