OpenFGA Preshared Key Exposure Vulnerability in Playground Endpoint

A vulnerability exists in OpenFGA versions 0.1.4 through 1.13.1, where the preshared API key is inadvertently exposed in the HTML response of the /playground endpoint. This issue arises when OpenFGA is configured to use preshared-key authentication, with the playground enabled and accessible beyond localhost or trusted networks. The /playground endpoint, which is enabled by default and does not require authentication, is intended for local development and debugging, not for production environments.

Impact

Exposing the preshared API key in the /playground endpoint response could allow unauthorized users to gain access to the API with the exposed key, potentially leading to unauthorized actions or data access.

Remediation

Users should upgrade to OpenFGA version 1.14.0 or disable the playground feature by running OpenFGA with the '--playground-enabled=false' option.