CVE description
If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache fails to key cached tokens by the requested audience. A valid, unexpired token minted for a sensitive service can consequently be retrieved from the cache and sent to a secondary service.
An attacker who operates, compromises, or monitors traffic to the secondary service can capture the token and replay it to impersonate the victim application against the sensitive service.
CVSS metrics
| Version | 4.0 |
|---|---|
| Score | 9.1 — Critical |
| Vector | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| Attack vector | Network |
| Attack complexity | Low |
| Attack requirements | Present: the attack depends on specific conditions, including a race condition or network injection. |
| Privileges required | None |
| User interaction | None |
| Impact | High confidentiality and integrity impact; no availability impact. |
Related weakness
CWE-524 — Use of Cache Containing Sensitive Information. The cache contains sensitive information that may be read outside the intended control sphere.
Reference reviewed and summarized by FXeSEC.