Ory Oathkeeper, an Identity & Access Proxy, fails to incorporate the introspection server URL into the cache key for oauth2_introspection authenticators. This flaw lets an attacker inject a valid token from one introspection endpoint into the cache and then reuse that same token with a different introspection server, thereby bypassing authentication checks for protected resources. The vulnerability enables unauthorized access to any resources guarded by the affected Oathkeeper deployment, compromising confidentiality and integrity of the protected services. The flaw is quantified with a CVSS score of 8.1 and is linked to CWE-1289 and CWE-305.

The issue affects the Ory Oathkeeper product, specifically any release prior to version 26.2.0 that configures multiple oauth2_introspection authenticators with caching enabled. System administrators using Oathkeeper versions before 26.2.0 should verify that caching is active for each authenticator and that the product is configured with distinct introspection URLs.

With a high severity CVSS score of 8.1 and an EPSS score below 1%, the risk level is significant yet the likelihood of widespread exploitation remains low according to current data. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a valid token for one introspection endpoint; an attacker then leverages cache key confusion to use the same token against another endpoint, making remote exploitation feasible through normal HTTP traffic to Oathkeeper. Due to the dependence on multiple authenticators and caching, defensive measures that disable caching or upgrade the software can effectively mitigate the threat.