An authentication race condition in the Juju API server’s userTokens map allows a logged‑in user to manipulate token processing. The flaw can lead to two adverse outcomes: it may corrupt the map and bring the server down, or it can enable reuse of a single‑use discharge token, undermining the intended one‑time authenticity guarantee. This is a classic race condition (CWE‑362).

Canonical’s Juju platform versions 4.0.5, 3.6.20 and 2.9.56 are vulnerable and should be upgraded if in use.

The CVSS score is 6.1, indicating a moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. An attacker must be authenticated to exploit the flaw, but once authenticated the potential to cause service interruption or bypass token restrictions makes timely remediation critical.