CVE-2026-33322

MinIO: JWT Algorithm Confusion in OIDC Authentication

State: Published
Severity: 9.2 Critical
Published: Mar 24, 2026
Updated: Mar 25, 2026
Reserved: Mar 18, 2026

Description

MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with any policy, including consoleAdmin. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
miniominio	>= RELEASE.2022-11-08T05-27-07Z, < RELEASE.2026-03-17T21-25-16ZAffected

References

https://github.com/minio/minio/security/advisories/GHSA-5cx5-wh4m-82fh

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.