cachecontroller

Jun 5, 2026 GO-2026-5322 +1 more

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jun 2, 2026 GO-2026-5322 +1 more

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

May 28, 2026 GO-2026-5322 +1 more

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

May 20, 2026 GO-2026-5322 +1 more

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

May 6, 2026 GO-2026-5239 +2 more

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 27, 2026 GO-2026-5239 +2 more

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 14, 2026 GO-2026-5239 +2 more

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 10, 2026 GO-2026-5239 +2 more

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 3, 2026 GO-2026-5136 +3 more

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Mar 24, 2026 GO-2026-5136 +5 more

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 23, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 19, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 13, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Feb 23, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Feb 11, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Feb 10, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jan 28, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Dec 4, 2025 GO-2026-4446 +7 more

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Nov 20, 2025 GO-2026-4446 +7 more

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Nov 5, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Nov 5, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Nov 4, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Oct 14, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Sep 30, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Sep 22, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Sep 11, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Aug 15, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Aug 13, 2025 GO-2025-3894 +9 more

  GO-2025-3894: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Aug 11, 2025 GO-2025-3894 +9 more

  GO-2025-3894: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jul 24, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jul 3, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jun 17, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jun 11, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jun 10, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

May 22, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

May 13, 2025 GO-2025-3707 +9 more

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Apr 30, 2025 GO-2025-3707 +9 more

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Apr 29, 2025 GO-2025-3657 +10 more

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Changes in this version

type CacheController

+ InvalidateIfNeeded func(storeID string, parentSpan trace.Span)

type InMemoryCacheController

+ func (c *InMemoryCacheController) InvalidateIfNeeded(storeID string, span trace.Span)

type NoopCacheController

+ func (c *NoopCacheController) InvalidateIfNeeded(_ string, _ trace.Span)

Apr 1, 2025 GO-2025-3657 +10 more

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 25, 2025 GO-2025-3657 +10 more

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 12, 2025 GO-2025-3657 +10 more

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Feb 20, 2025 GO-2025-3657 +10 more

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Feb 19, 2025 GO-2025-3657 +10 more

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Changes in this version

type CacheController

+ DetermineInvalidationTime func(ctx context.Context, storeID string) time.Time

type InMemoryCacheController

+ func (c *InMemoryCacheController) DetermineInvalidationTime(ctx context.Context, storeID string) time.Time

+ type InMemoryCacheControllerOpt func(*InMemoryCacheController)

+ func WithLogger(logger logger.Logger) InMemoryCacheControllerOpt

type NoopCacheController

+ func (c *NoopCacheController) DetermineInvalidationTime(_ context.Context, _ string) time.Time

Jan 13, 2025 GO-2025-3470 +10 more

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jan 3, 2025 GO-2025-3470 +10 more

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Dec 13, 2024 GO-2025-3384 +11 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Dec 5, 2024 GO-2025-3384 +11 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Nov 8, 2024 GO-2025-3384 +11 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Oct 30, 2024 GO-2025-3384 +9 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ type CacheController interface

+ DetermineInvalidation func(ctx context.Context, storeID string) time.Time

+ func NewCacheController(ds storage.OpenFGADatastore, cache storage.InMemoryCache[any], ...) CacheController

+ func NewNoopCacheController() CacheController

+ type InMemoryCacheController struct

+ func (c *InMemoryCacheController) DetermineInvalidation(ctx context.Context, storeID string) time.Time

+ type NoopCacheController struct

+ func (c *NoopCacheController) DetermineInvalidation(_ context.Context, _ string) time.Time