A race condition exists in the web management daemon of Brocade Fabric OS prior to version 10.0.1. When multiple authentication requests are handled concurrently, the daemon can cause PAM modules to process stale or incorrect client IP addresses and switch security contexts. This thread‑safety flaw results in inaccurate audit records and enables attackers to bypass access control policies that rely on client‑IP‑based AAA evaluation or Calling‑Station‑ID ACLs. The weakness is a classic race condition (CWE‑362).

Brocade Fabric OS versions earlier than 10.0.1 are affected. The issue resides in the web management daemon responsible for handling user authentication requests.

The CVSS score is 2.1, indicating low overall severity, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through the web management interface, where an attacker could trigger the race condition by sending concurrent authentication requests. Exploitation would require the ability to interact with the web service and could lead to mask or bypassed audit records and granular access control failures.