The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.

CVE-2026-82454 describes a critical authentication bypass vulnerability in the Omnivore API (packages/api) affecting Apple Sign-In token verification. The decodeAppleToken function incorrectly trusted the attacker-supplied 'alg' field from the JWT header, passing it directly to jwt.verify() as the allowed algorithm. By setting alg=HS256 and using Apple's publicly available RSA public key as an HMAC secret, an attacker could forge a valid-looking JWT token. The jsonwebtoken v8 library used did not validate key/algorithm compatibility, enabling the bypass. This flaw allowed an attacker to impersonate any Apple-linked Omnivore account without knowing the victim's credentials. The vulnerability was fixed in commit abf53d6. This is a classic JWT algorithm confusion attack, a well-known class of vulnerability in token-based authentication systems.