CVE-2026-33322 — Improper Authentication in Minio

CWE-287 — Improper AuthenticationCWE-327 — Use of a Broken or Risky Cryptographic Algorithm5 documents4 sources
Severity
9.2CRITICALNVD
GHSA7.5OSV7.5
EPSS
0.0%
top 93.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MinioGithub.com Minio Minio
Timeline
Latest updateMar 23
PublishedMar 24

Description

MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with any policy, including consoleAdmin. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages3 packages

▶NVDminio/minio2022-11-08t05-27-07z — 2026-03-17t21-25-16z
▶Gogithub.com/minio_minio0.0.0-20260212201848-7aac2a2c5b7c
▶CVEListV5minio/minio>= RELEASE.2022-11-08T05-27-07Z, < RELEASE.2026-03-17T21-25-16Z

🔴Vulnerability Details

3
OSV
MinIO has JWT Algorithm Confusion in OIDC Authentication in github.com/minio/minio↗2026-03-23
▶
GHSA
MinIO has JWT Algorithm Confusion in OIDC Authentication↗2026-03-19
▶
OSV
MinIO has JWT Algorithm Confusion in OIDC Authentication↗2026-03-19
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-33322 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶