Oxia, a metadata store and coordination system, prior to version 0.16.2, contains an authentication vulnerability where the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration. This disables the standard audience (aud) claim validation at the library level, allowing tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia. This improper authentication weakness is tracked as CWE-287 and has a CVSS 4.0 score of 9.2, indicating critical severity. The vulnerability is resolved in version 0.16.2.

The vulnerability allows acceptance of OIDC tokens intended for other services, potentially enabling unauthorized access to Oxia. This can lead to privilege escalation or unauthorized operations within the affected system. No known exploits in the wild have been reported to date.

Upgrade Oxia to version 0.16.2 or later, where the vulnerability is fixed by properly validating the audience claim in OIDC tokens. Since no official patch link or advisory is provided, users should verify the version and apply the update accordingly. Patch status is not explicitly confirmed beyond the version fix note; check the vendor's official channels for the latest remediation guidance.