The flaw resides in Angular's @angular/common HttpTransferCache, where a hierarchical HttpClient configured with withRequestsMadeViaParent can unintentionally cache an authenticated response. A parent HttpClient later injects credentials through interceptors, yet the child cache records the prior anonymous request and then stores the authenticated payload in TransferState. The serialized JSON is included in the ng‑state script of the Server‑Side Rendered HTML, allowing unprivileged users to receive data that should have been kept private. This is a classic leakage of confidential information, identified by CWE‑200 and CWE‑524.

Angular projects using the @angular/common HttpTransferCache with Server‑Side Rendering and hydration before the release of Angular v20.3.28, v21.2.20, or v22.1.1 are affected. The vulnerability arises only when a child HttpClient is delegated via withRequestsMadeViaParent and the parent applies credential‑based interceptors. Users of higher Angular versions are not impacted.

The CVSS score of 4 indicates a low severity assessment, and the EPSS score is not available, suggesting limited probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires specific conditions: SSR HTML that is cached and shared among users by a CDN, reverse proxy, or application cache; the presence of parent and child HttpClients; and credential injection at the parent level. Once these criteria are met, an attacker can retrieve the cached HTML and read the private response data, but the attack surface is relatively narrow, making it less likely to be widely used.