MinIO has JWT Algorithm Confusion in OIDC Authentication
Date: 2026-03
Affected: go/github.com/minio/minio
Attack vector: deepfake
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-33322
CWE: CWE-287
CWE-327

### Impact _What kind of vulnerability is it? Who is impacted?_ A JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC `ClientSecret` to forge arbitrary identity tokens and obtain S3 credentials with any policy, including `consoleAdmin`. An attacker with knowledge of the OIDC `ClientSecret` can: - Impersonate any user identity - Obtain S3 credentials with any IAM policy, including `consoleAdmin` - Access, modify, or delete any data in the MinIO deployment The attack is deterministic (100% success rate, no race conditions). #### Attack Prerequisites The attacker must know the OIDC `ClientSecret`. While this is a shared credential (not a private key), it is more accessible than commonly assumed: - CVE-2023-28432 previously leaked environment variables including `MINIO_IDENTITY_OPENID_CLIENT_SECRET` - Client secrets are often present in frontend OAuth configurations, mobile app bundles, CI/CD pipelines, and shared configuration files - In many organizations, the client secret is accessible to operators and engineers who should not be able to forge arbitrary identities #### Affected Versions All MinIO releases from `RELEASE.2022-11-08T05-27-07Z` through the final release of the `minio/minio` open-source project. ### Patches **Fixed in:** MinIO AIStor `RELEASE.2026-03-17T21-25-16Z` ## Downloads ### Binary Downloads | Platform | Architecture | Download


Mitigations:

Architectural layers (MAESTRO):