CVE-2026-92787 — Feast through 0.66.0 Authentication Bypass via Unverified Token
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverifi…
Published: 2026-09-16 · CVSS: 9.3 · CVSS 4.0
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7