Technical impact
CedarJava contains an inverted logic bug in the EntityIdentifier.equals() method, where null values are treated as equal and self‑comparisons return false. This flaw leads to incorrect identity checks that could cause application components to treat distinct entities as the same or fail to recognize identical entities. The core Cedar authorization engine, which is implemented in Rust, is not affected because JSON policy evaluation does not invoke this method. However, any integrator code that performs manual equality checks on EntityIdentifier objects risks introducing logic errors or incorrect audit trails697, CWE-843, and CWE-94 weaknesses.
Affected Systems
The affected product is cedar-policy's cedar-java library. Versions earlier than 4.9.0 are susceptible; version 4.9.0 and later contain the fix.
Risk and Exploitability
The CVSS score of 8.8 classifies this indicating significant potential for misuse in integration code that relies on EntityIdentifier comparisons. Because the bug is limited to local equality checks The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting no current widespread exploitation. The high severity and the potential for subtle identity confusion, however, warrant prompt attention.
Github GHSA