Authorization Bypass

2022-10-2605:17:33

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

openfga

authorization

bypass

vulnerability

error

wildcard

evaluation

model

tuple set relations

EPSS

0.002

Percentile

59.3%

JSON

github.com/openfga/openfga is vulnerable to authorization bypass. The vulnerability is due to a lack of an error if a wildcard is encountered in the ttu evaluation when the wildcard (``) is defined in the authorization model’s tuple set relations.