This vulnerability allows an unauthenticated attacker to bypass authorization middleware by sending a percent‑encoded pathname that does not match the middleware but resolves to the cache key of a protected route. The attacker can retrieve cached content intended for authenticated users, leading to unauthorized disclosure of confidential data. Malformed encodings can also be partially decoded, further enabling the bypass.

OpenNext Cloudflare adapter for Cloudflare, identified as opennextjs:opennextjs-cloudflare. Versions from 0.3.0 through 1.20.2 are affected. The fix is included in version 1.20.2 and later.

The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1% suggests the likelihood of widespread exploitation is currently low, and it is not listed in CISA’s KEV catalog. A remote attacker can trigger the flaw by crafting an encoded URL that satisfies the cache lookup but fails middleware checks, enabling unauthorized retrieval of cached protected content. The vulnerability does not require elevated privileges and can be exploited over standard HTTP(S) traffic to the Cloudflare‑proxied application.