https://silo.pgsty.com/tags/oidc/Recent content in OIDC on SILOHugoenSun, 02 Aug 2026 15:22:46 +0800https://silo.pgsty.com/blog/security/cve-2026-33322/Wed, 15 Apr 2026 00:00:00 +0000https://silo.pgsty.com/blog/security/cve-2026-33322/<p><strong>Status:</strong> Released<br> <strong>First containing release:</strong> <a href="https://github.com/pgsty/minio/releases/tag/RELEASE.2026-04-17T00-00-00Z">RELEASE.2026-04-17T00-00-00Z</a><br> <strong>Affected entry points:</strong> <code>AssumeRoleWithWebIdentity</code>, <code>AssumeRoleWithClientGrants</code><br> <strong>GitHub issue:</strong> <a href="https://github.com/pgsty/minio/issues/22">pgsty/minio#22</a></p> <p>The old implementation placed the OIDC client secret in the JWT verifier keyring while also accepting HMAC signing methods. An attacker who knew that client secret could therefore mint an HS-signed token and exchange it through STS for temporary credentials. The final fix restored asymmetric, JWKS-only verification. It deliberately broke HS256/384/512 compatibility instead of keeping an option that would reintroduce ambiguous trust semantics.</p>