CVE-2026-82454: Improper Verification of Cryptographic Signature in omnivore-app omnivore

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass vulnerability in the Apple sign-in token verification process. The decodeAppleToken function extracts the 'alg' field from the attacker-controlled JWT header and uses it as the sole allowed algorithm in jwt.verify(). Because jsonwebtoken v8 does not validate the compatibility between the key and algorithm, an attacker can specify alg=HS256 and sign a forged token using Apple's RSA public key as the HMAC secret. This allows bypassing signature verification and impersonating any Apple-linked account.

This vulnerability allows an unauthenticated attacker to bypass authentication by forging Apple sign-in tokens, leading to account impersonation of any user linked to Apple sign-in. The CVSS 4.0 score is 9.3 (critical), indicating a high-impact security flaw with network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity.

A fix is available as indicated by the mention of a fix in commit abf53d6. Users of the Omnivore API should update to the fixed version that corrects the token verification logic to properly validate the cryptographic signature and algorithm compatibility. No additional mitigation is indicated.