Omnivore-app vulnerabilities
We track 1 vulnerability in Omnivore-app products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on August 29, 2026.
1vulnerabilities
1critical
0high
0exploited
9.1average CVSS score
Latest Omnivore-app vulnerabilities
- 9.1 Critical severity
omnivore: Improper Verification of Cryptographic Signature
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allo