A cache key collision exists in the TopicSelectorStore component of the Mercure protocol. The key is built by concatenating a topic selector with a topic using an underscore separator; because both strings can contain underscores, two distinct selector‑topic pairs can produce the same key. When this collision occurs, the match result cache can hold inaccurate data, enabling an attacker to have private updates delivered to unauthorized subscribers or to block delivery to authorized ones. This results in bypassing authorization checks and potentially exposing confidential information.

All instances of Mercure by dunglas released before version 0.22.0 are affected. The two‑part key collision flaw does not discriminate between sub‑releases, so any hub running a pre‑0.22.0 release is vulnerable until the upgrade is applied.

The CVSS vector assigns a score of 7.1, indicating a medium severity vulnerability. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is remote engagement through the hub’s subscription or publication endpoints, which an attacker can access over the network. Based on the description, it is inferred that an attacker must be able to send crafted subscription requests or publish messages with specially formed topic selectors and topics containing underscores. Once such a collision is created, the bug can affect all users who interact with the hub, so the risk is notable for publicly exposed or poorly secured instances of Mercure.