Ceph versions 19.2.3 and below are vulnerable to an authentication bypass in the RadosGW OIDC provider. The vulnerability allows an attacker to send a JWT token with the algorithm set to "none", bypassing signature verification. This flaw enables unauthorized access due to improper JWT validation. A fix is available in version 20.2.1.