test

Jun 5, 2026 GO-2026-5322 +1 more

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jun 2, 2026 GO-2026-5322 +1 more

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

May 28, 2026 GO-2026-5322 +1 more

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

May 20, 2026 GO-2026-5322 +1 more

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

May 6, 2026 GO-2026-5239 +2 more

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 27, 2026 GO-2026-5239 +2 more

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 14, 2026 GO-2026-5239 +2 more

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 10, 2026 GO-2026-5239 +2 more

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 3, 2026 GO-2026-5136 +3 more

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Mar 24, 2026 GO-2026-5136 +5 more

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 23, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 19, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 13, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Feb 23, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Feb 11, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Feb 10, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jan 28, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Dec 4, 2025 GO-2026-4446 +7 more

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Nov 20, 2025 GO-2026-4446 +7 more

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Nov 5, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Nov 5, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Nov 4, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Changes in this version

+ func TestListObjectsWithPipeline(t *testing.T, ds storage.OpenFGADatastore)

Oct 14, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Sep 30, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Sep 22, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Sep 11, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Aug 15, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Aug 13, 2025 GO-2025-3894 +9 more

  GO-2025-3894: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Aug 11, 2025 GO-2025-3894 +9 more

  GO-2025-3894: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jul 24, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jul 3, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jun 17, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jun 11, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jun 10, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

May 22, 2025 GO-2025-4150 +8 more

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

May 13, 2025 GO-2025-3707 +9 more

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Apr 30, 2025 GO-2025-3707 +9 more

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Apr 29, 2025 GO-2025-3657 +10 more

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Apr 1, 2025 GO-2025-3657 +10 more

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 25, 2025 GO-2025-3657 +10 more

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 12, 2025 GO-2025-3657 +10 more

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Feb 20, 2025 GO-2025-3657 +10 more

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Feb 19, 2025 GO-2025-3657 +10 more

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4446: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jan 13, 2025 GO-2025-3470 +10 more

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Jan 3, 2025 GO-2025-3470 +10 more

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Dec 13, 2024 GO-2025-3384 +11 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Dec 5, 2024 GO-2025-3384 +11 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Nov 8, 2024 GO-2025-3384 +11 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3707: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Oct 30, 2024 GO-2025-3384 +9 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ func BenchmarkCheck(b *testing.B, ds storage.OpenFGADatastore)

+ func BenchmarkReadChanges(b *testing.B, ds storage.OpenFGADatastore)

Oct 3, 2024 GO-2025-3384 +9 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Sep 12, 2024 GO-2025-3384 +9 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Aug 30, 2024 GO-2025-3384 +9 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Aug 14, 2024 GO-2025-3384 +9 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Aug 8, 2024 GO-2024-3061 +10 more

  GO-2024-3061: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jul 26, 2024 GO-2024-3061 +10 more

  GO-2024-3061: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jul 17, 2024 GO-2025-3384 +9 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jun 18, 2024 GO-2025-3384 +9 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

May 29, 2024 GO-2025-3384 +9 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ func BenchmarkListUsers(b *testing.B, ds storage.OpenFGADatastore)

May 1, 2024 GO-2025-3384 +9 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 16, 2024 GO-2025-3384 +9 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 3, 2024 GO-2024-2729 +10 more

  GO-2024-2729: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Mar 20, 2024 GO-2024-2729 +10 more

  GO-2024-2729: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Mar 1, 2024 GO-2024-2729 +10 more

  GO-2024-2729: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jan 26, 2024 GO-2025-3384 +9 more

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jan 10, 2024 GO-2024-2477 +10 more

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jan 4, 2024 GO-2024-2477 +10 more

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Dec 11, 2023 GO-2024-2477 +10 more

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-4150: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Nov 3, 2023 GO-2024-2477 +9 more

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Dec 8, 2023 GO-2024-2477 +9 more

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Dec 6, 2023 GO-2024-2477 +9 more

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Dec 4, 2023 GO-2024-2477 +9 more

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3384: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ func TestListObjects(t *testing.T, ds storage.OpenFGADatastore)

Nov 7, 2023 GO-2024-2477 +8 more

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Nov 6, 2023 GO-2024-2477 +8 more

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2025-3657: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ func TestWriteAndReadAssertions(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestWriteAssertionsFailure(t *testing.T, datastore storage.OpenFGADatastore)

Oct 26, 2023 GO-2024-2477 +7 more

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ func BenchmarkListObjects(b *testing.B, ds storage.OpenFGADatastore)

Oct 17, 2023 GO-2024-2477 +7 more

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ func TestReadChangesAfterConcurrentWritesReturnsUniqueResults(t *testing.T, datastore storage.OpenFGADatastore)

Oct 5, 2023 GO-2023-2121 +8 more

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Sep 26, 2023 GO-2023-2121 +8 more

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ func TestReverseExpand(t *testing.T, ds storage.OpenFGADatastore)

Aug 25, 2023 GO-2023-2084 +9 more

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Aug 1, 2023 GO-2023-2028 +10 more

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jun 30, 2023 GO-2023-2028 +10 more

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jun 27, 2023 GO-2023-2028 +10 more

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jun 22, 2023 GO-2023-2028 +10 more

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jun 7, 2023 GO-2023-2028 +10 more

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jun 26, 2023 GO-2023-2028 +10 more

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ const DefaultResolveNodeLimit

May 17, 2023 GO-2023-1872 +11 more

  GO-2023-1872: Denial of service in github.com/openfga/openfga

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 18, 2023 GO-2023-1872 +11 more

  GO-2023-1872: Denial of service in github.com/openfga/openfga

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 14, 2023 GO-2023-1872 +11 more

  GO-2023-1872: Denial of service in github.com/openfga/openfga

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 12, 2023 GO-2023-1872 +11 more

  GO-2023-1872: Denial of service in github.com/openfga/openfga

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Mar 17, 2023 GO-2023-1872 +11 more

  GO-2023-1872: Denial of service in github.com/openfga/openfga

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Mar 16, 2023 GO-2023-1872 +11 more

  GO-2023-1872: Denial of service in github.com/openfga/openfga

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Mar 15, 2023 GO-2023-1872 +11 more

  GO-2023-1872: Denial of service in github.com/openfga/openfga

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ func TestListObjectsRespectsMaxResults(t *testing.T, ds storage.OpenFGADatastore)

Feb 22, 2023 GO-2023-1872 +11 more

  GO-2023-1872: Denial of service in github.com/openfga/openfga

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Feb 16, 2023 GO-2023-1872 +11 more

  GO-2023-1872: Denial of service in github.com/openfga/openfga

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Feb 15, 2023 GO-2023-1872 +11 more

  GO-2023-1872: Denial of service in github.com/openfga/openfga

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Feb 3, 2023 GO-2023-1872 +11 more

  GO-2023-1872: Denial of service in github.com/openfga/openfga

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ func BenchmarkCheckWithDirectResolution(b *testing.B, datastore storage.OpenFGADatastore)

Jan 31, 2023 GO-2023-1872 +11 more

  GO-2023-1872: Denial of service in github.com/openfga/openfga

  GO-2023-2028: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2023-2084: OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga

  GO-2023-2121: OpenFGA DoS vulnerability in github.com/openfga/openfga

  GO-2024-2477: OpenFGA denial of service in github.com/openfga/openfga

  GO-2025-3470: OpenFGA Authorization Bypass in github.com/openfga/openfga

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ func BenchmarkCheckWithTrace(b *testing.B, datastore storage.OpenFGADatastore)

+ func BenchmarkCheckWithoutTrace(b *testing.B, datastore storage.OpenFGADatastore)

+ func BenchmarkListObjectsWithConcurrentChecks(b *testing.B, ds storage.OpenFGADatastore)

+ func BenchmarkListObjectsWithReverseExpand(b *testing.B, ds storage.OpenFGADatastore)

+ func CheckQueryTest(t *testing.T, datastore storage.OpenFGADatastore)

+ func ConnectedObjectsTest(t *testing.T, ds storage.OpenFGADatastore)

+ func ListObjectsTest(t *testing.T, ds storage.OpenFGADatastore)

+ func NewMockStreamServer(size int) *mockStreamServer

+ func ReadAllTuplesInvalidContinuationTokenTest(t *testing.T, datastore storage.OpenFGADatastore)

+ func ReadAllTuplesTest(t *testing.T, datastore storage.OpenFGADatastore)

+ func ReadAuthorizationModelTest(t *testing.T, datastore storage.OpenFGADatastore)

+ func ReadQueryErrorTest(t *testing.T, datastore storage.OpenFGADatastore)

+ func ReadQuerySuccessTest(t *testing.T, datastore storage.OpenFGADatastore)

+ func RunAllBenchmarks(b *testing.B, ds storage.OpenFGADatastore)

+ func RunAllTests(t *testing.T, ds storage.OpenFGADatastore)

+ func RunCheckBenchmarks(b *testing.B, ds storage.OpenFGADatastore)

+ func RunCommandTests(t *testing.T, ds storage.OpenFGADatastore)

+ func RunListObjectsBenchmarks(b *testing.B, ds storage.OpenFGADatastore)

+ func RunQueryTests(t *testing.T, ds storage.OpenFGADatastore)

+ func TestCheckQueryAuthorizationModelsVersioning(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestCreateStore(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestDeleteStore(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestExpandQuery(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestExpandQueryErrors(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestGetStoreQuery(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestGetStoreSucceeds(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestListStores(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestReadAssertionQuery(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestReadAuthorizationModelQueryErrors(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestReadAuthorizationModelsInvalidContinuationToken(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestReadAuthorizationModelsWithPaging(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestReadAuthorizationModelsWithoutPaging(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestReadChanges(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestReadChangesReturnsSameContTokenWhenNoChanges(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestSuccessfulReadAuthorizationModelQuery(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestWriteAssertions(t *testing.T, datastore storage.OpenFGADatastore)

+ func TestWriteCommand(t *testing.T, datastore storage.OpenFGADatastore)

+ func WriteAuthorizationModelTest(t *testing.T, datastore storage.OpenFGADatastore)