Apple Sign-In JWT Algorithm Confusion Authentication Bypass

CVE-2026-82454 represents a critical authentication bypass in Omnivore's Apple sign-in implementation, stemming from unsafe JWT token verification practices. The vulnerability exploits a common cryptographic pitfall: the decodeAppleToken function extracts the 'alg' parameter directly from untrusted JWT headers without validation, then passes it as the sole permitted algorithm to jwt.verify(). An attacker can forge valid tokens by setting alg=HS256 (HMAC-based) while signing with Apple's publicly available RSA public key as the HMAC secret—a technique known as algorithm confusion. This affects any deployment using the vulnerable Omnivore API version, potentially compromising user authentication and authorization across integrated applications that rely on Apple sign-in for account access.

While Casky.ai currently has zero mapped skills specifically for this CVE, practitioners using Claude AI with extended reasoning can detect the attack patterns underlying this vulnerability through reconnaissance and credential access analysis. The exploitation chain manifests as suspicious JWT token anomalies: unexpected algorithm fields in authentication headers, mismatches between declared and actual signature schemes, and successful authentication using public key material as symmetric secrets. Security teams should implement detection rules monitoring for algorithm confusion patterns (CWE-347), validate algorithm-key compatibility before verification, and enforce strict JWT validation libraries that prevent attacker-controlled algorithm selection. Practitioners would benefit from Casky skill development targeting secure cryptographic implementation patterns and JWT validation best practices to surface these logic flaws during code review and threat modeling exercises.