Omnivore API Authentication Bypass Vulnerability: Early Warning

Severity

CRITICAL

CVSS

9.1

Affected component

omnivore-api (npm)

Affected versions

>= android-0.220.0, <= android-0.220.0 or >= android-0.218.0, <= android-0.218.0 or >= android-0.202.4, <= android-0.202.4 or >= android-0.202.3, <= android-0.202.3 or >= android-0.202.0, <= android-0.202.0 or >= android-0.200.8, <= android-0.200.8 or >= android-0.200.5, <= android-0.200.5 or >= android-0.200.4, <= android-0.200.4 or >= android-0.200.2, <= android-0.200.2 or >= android-0.200.1, <= android-0.200.1 or >= android-0.194.1, <= android-0.194.1 or >= android-0.194.0, <= android-0.194.0 or >= android-0.192.0, <= android-0.192.0 or >= android-0.190.0, <= android-0.190.0 or >= android-0.0.170, <= android-0.0.170 or >= android-0.0.178, <= android-0.0.178 or >= android-0.0.158, <= android-0.0.158 or >= android-0.0.152, <= android-0.0.152 or >= extension-2.8.9, <= extension-2.8.9 or >= android-0.0.146, <= android-0.0.146 or >= android-0.0.134, <= android-0.0.134 or >= android-0.0.132, <= android-0.0.132 or >= android-0.0.130, <= android-0.0.130 or >= android-0.0.126, <= android-0.0.126 or >= android-0.0.124, <= android-0.0.124 or >= android-0.0.122, <= android-0.0.122 or >= android-0.0.118, <= android-0.0.118 or >= android-0.0.110, <= android-0.0.110 or >= android-0.0.102, <= android-0.0.102 or >= android-0.0.101, <= android-0.0.101 or >= v1.4.2-10, <= v1.4.2-10

Patched version

Not yet available

An early warning has been issued for a critical vulnerability in the Omnivore API that reportedly allows an authentication bypass in Apple sign-in token verification. This could enable an attacker to impersonate any Apple-linked account.

What happened

The Omnivore API is under investigation for a critical vulnerability identified as CVE-2026-82454. This vulnerability, with a CVSS score of 9.1, involves an authentication bypass in the Apple sign-in token verification process. An attacker exploiting this flaw could potentially bypass signature verification and impersonate any account linked with Apple credentials. The vulnerability affects multiple versions of the omnivore-api npm package, as detailed in the affected components section. There are no reports of this vulnerability being exploited in the wild at this time.

To assess your exposure, review your use of the omnivore-api npm package and compare it against the affected version ranges provided. If your implementation falls within the specified ranges, you are potentially vulnerable to this authentication bypass.

What to do about it

• Upgrade to the latest version of the Omnivore API to mitigate the risk of this vulnerability.
• Review any Apple sign-in implementations in your systems for potential vulnerabilities related to token verification.
• Monitor the primary sources for updates on this vulnerability and any official fixes that may be released.
• Consider implementing additional security measures for Apple sign-in processes as a precautionary step.

How 0Day would have caught this

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Sources

• [CVE-2026-82454] CVSS 9.1 CRITICAL

Join the 0Day waitlist →

← Back to all threats