Cache‑key delimiter injection in OpenFGA’s iterator caches allows two distinct authorization check requests to produce the same cache key. As a result, a previously cached decision is reused for a new request, enabling an attacker to poison the cache and obtain unauthorized access within the same store. This results in an authorization bypass that can compromise the confidentiality and integrity of protected resources, corresponding to CWE‑345, CWE‑639, and CWE‑668 weaknesses.

All OpenFGA installations (openfga/openfga) running versions prior to 1.16.0 that have iterator caching enabled are affected. The vendor released a patch in v1.16.0 that removes the cache-key collision issue.

The CVSS score of 5.0 indicates moderate severity. EPSS score < 1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The exploit requires an attacker to send crafted authorization queries to an OpenFGA instance with iterator caching enabled, implying that the risk is primarily confined to systems where the service is publicly accessible and caching is used. Although no active exploits are known, the possibility of unauthorized access remains if the patch is not applied. The likely attack vector is remote, via crafted authorization requests.