Read the docs
TI-2026-25892 Aliases CVE-2026-33496GHSA-4mq7-pvjg-xp2r

Ory Oathkeeper has an authentication bypass by cache key confusion

Priority LOW 35CWE-1289Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to authentication bypass due to cache key confusion. The `oauth2_introspection` authenticator cache does not distinguish tokens that were validated with different introspection URLs. An attacker can therefore legitimately use a token to prime the cache, and subsequently use the same token for rules that use a different introspection server. Ory Oathkeeper has to be configured with multiple `oauth2_introspection` authenticator servers, each accepting different tokens. The authenticators also must be configured to use caching. An attacker has to have a way to gain a valid token for one of the configured introspection servers. Starting in version 26.2.0, Ory Oathkeeper includes the introspection server URL in the cache key, preventing confusion of tokens. Update to the patched version of Ory Oathkeeper. If that is not immediately possible, disable caching for `oauth2_introspection` authenticators.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix Fixed oathkeeper (ory): 26.2.0github.com/ory/oathkeeper (Go): 0.40.10-0.20260320084801-198a2bc82a99

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
oryoathkeeperbefore 26.2.026.2.0Patch availableCNA
—github.com/ory/oathkeeper (Go)before 0.40.10-0.20260320084801-198a2bc82a990.40.10-0.20260320084801-198a2bc82a99Patch availableGHSA-4mq7-pvjg-xp2r
  • oathkeeper Vendorory Affected before 26.2.0 Fixed in 26.2.0 Patch available CNA
  • github.com/ory/oathkeeper (Go) Vendor— Affected before 0.40.10-0.20260320084801-198a2bc82a99 Fixed in 0.40.10-0.20260320084801-198a2bc82a99 Patch available GHSA-4mq7-pvjg-xp2r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ory:oathkeeper:*:*:*:*:*:*:*:*before 26.2.0Vulnerableory
  • cpe:2.3:a:ory:oathkeeper:*:*:*:*:*:*:*:* Versions before 26.2.0 Vulnerable ·ory

Remediation

  • Fix · CNA oathkeeper (ory) Fixed in 26.2.0
  • Fix · GHSA-4mq7-pvjg-xp2r github.com/ory/oathkeeper (Go) Fixed in 0.40.10-0.20260320084801-198a2bc82a99 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33496
  2. 2026-10-03 Alias added: GHSA-4mq7-pvjg-xp2r

References

Patch 1

Advisory 2

Other 1

  • TI-2026-25890 Ory Oathkeeper has a path traversal authorization bypass CVSS 3.1CRITICAL 10.0
  • TI-2021-12369 Possible bypass of token claim validation when OAuth2 Introspection caching is enabled CVSS 3.1HIGH 7.5
  • TI-2026-25891 Ory Oathkeeper has an authentication bypass by usage of untrusted header CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences