AIKIDO-2026-515930
mlflow-oidc-auth is vulnerable to Authentication Bypass
98
Critical Risk
This Affects:
mlflow-oidc-authTL;DR
The OIDC authentication plugin validates JWT bearer tokens with a decoder that trusts the algorithm named in each token's own unauthenticated header. Because the accepted algorithm set is not pinned, a token can declare a symmetric algorithm such as HS256 and be verified using the provider's public JWKS key as the HMAC secret, or declare alg: none and carry no signature at all. This lets an unauthenticated request forge a token for any account, including administrators, and pass validation. The fix pins verification to the provider's asymmetric algorithms so symmetric and unsigned tokens are refused before any signature check.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your deployment accepts OIDC JWT bearer tokens for authentication.
Background info
mlflow-oidc-auth is vulnerable to Authentication Bypass in versions 3.0.0 - 7.12.1.
How to fix this
Upgrade the mlflow-oidc-auth library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.