A race condition in the shared Extreme Platform ONE IAM Gateway API‑key authentication path allows requests authenticated with an Extreme Platform ONE /IAM‑issued API key to receive response data belonging to another tenant under specific high‑concurrency traffic conditions. The flaw is a classic thread‑safety issue (CWE‑362) and a resource contention race (CWE‑488) that can let an attacker temporarily access data it should not see. The vulnerability is limited to API‑key authentication only; XIQ‑native tokens and standard OAuth/Bearer JWT authentication remain unaffected.

Licensing platform: Extreme Networks Extreme Platform ONE has been found vulnerable. The issue manifests in the ExtremeCloud IQ and XIQ API endpoints as well as the Common Services API paths used by Extreme Platform ONE. No specific affected version numbers were provided in the advisory, so any installation still using the default IAM Gateway API‑key method is potentially impacted.

The CVSS score of 6.3 places the vulnerability at moderate severity. Because the EPSS score is not available and the incident is not listed in CISA KEV, the exploitation likelihood appears low at present. However, the race condition requires high‑concurrency traffic to trigger and may be difficult to reproduce reliably, but once triggered it results in inadvertent data leakage across tenants. Administrators should consider the risk moderate and take proactive measures until a vendor patch is released.