The vulnerability is an improper authorization flaw that allows an authenticated remote attacker to use an access token issued for one resource to authenticate to any resource in any organization. Because the token validation does not enforce the intended resource ID, a token scoped to resource X can be reused for resource Y in another organization, enabling cross‑resource access. This flaw corresponds to CWE‑639, where authorization checks are bypassed due to user‑controlled data.

The affected product is the open‑source project fosrl/Pangolin. The vulnerability exists in all releases up through version 1.20.0, and any earlier release that has not been patched has the same issue. Users should verify that they are running a version later than 1.20.0 or have applied a patch that fixes the token validation logic.

The CVSS score of 9.6 classifies this as a critical vulnerability, with a high degree of impact and a requirement for network access as the attacker merely needs a valid token for a resource. The EPSS score is not available, and the issue is not yet listed in CISA’s KEV catalog, yet the flaw’s logic makes exploitation likely in environments where tokens are not tightly scoped or where cross‑org access is a concern. An attacker who can obtain or guess a token for one resource can immediately gain unauthorized authentication to any resource, effectively bypassing all resource‑level access controls.