CVE-2026-33322CWE-287

MinIO: JWT Algorithm Confusion in OIDC Authentication

Critical · published March 24, 2026

CVSS v4.0
9.2
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with any policy, including consoleAdmin. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00629 · 49.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-03-24T19:05Z
EPSS history
Timeline
  • 24 MAR 19:05Z
    MinIO: JWT Algorithm Confusion in OIDC Authentication
    cvelistv5