OpenFGA is an authorization engine that relies on cached evaluations of condition logic to improve performance. In versions prior to 1.13.1, when caching is enabled for models that use condition evaluation, two distinct authorization check requests can produce the same cache key. The engine may then return a cached result belonging to a different request, allowing an attacker to gain permissions they should not have. This flaw effectively bypasses the authorization intended by the model, matching the weaknesses listed as CWE‑1289, CWE‑20, and CWE‑345.

Installations of the OpenFGA authorization service running a version older than 1.13.1 that enable condition evaluation caching are affected. The vulnerability applies to all OpenFGA products, as reflected in the CPE string for the openfga:openfga package. Users whose models include relations that depend on condition evaluation with caching should consider an update.

With a CVSS score of 5.8, the flaw is classified as medium severity, and an EPSS score below 1% indicates low current exploit likelihood. It is not listed in the CISA KEV catalog, suggesting limited widespread exploitation. The likely attack vector involves sending crafted authorization requests through the OpenFGA API to trigger the cache key collision; this is inferred from the description and not explicitly documented. If successful, the attacker may read a cached authorization result that applies to a different user or action, effectively bypassing intended access controls.