A critical authentication bypass vulnerability in the Omnivore API allows unauthenticated remote attackers to impersonate any user account linked to Apple sign-in.

This vulnerability, categorized as CWE-347, involves improper verification of cryptographic signatures within the decodeAppleToken function. By manipulating the algorithm header in a JWT, an unauthenticated attacker can force the application to use an insecure verification method, effectively bypassing all security controls.

The ability to impersonate any user account provides an attacker with complete access to private user data and account functions. Given the CVSS score of 9.1, this flaw presents a severe risk of unauthorized data exposure and account takeover, potentially leading to widespread reputational damage and loss of user trust.

Immediate Action: Update the Omnivore application immediately to the version containing the fix for commit abf53d650875.

Proactive Monitoring: Review authentication and API access logs for anomalous login patterns or spikes in unauthorized token validation attempts.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and filter incoming JWT headers, specifically blocking requests that attempt to force algorithm changes to HMAC variants.

Public Exploit Available: Unknown

This vulnerability is critical because it removes the primary authentication gate for users utilizing Apple sign-in. Security teams must prioritize patching this component immediately to prevent potential account takeovers. Organizations that cannot update immediately should consider temporarily disabling Apple sign-in functionality until the patch is verified and deployed.