Skip to content
Threat Feed
Subscribe

Tag

Oathkeeper

1 brief RSS
high advisory

ORY Oathkeeper Authentication Bypass Vulnerability (CVE-2026-33496)

ORY Oathkeeper before 26.2.0 is vulnerable to authentication bypass (CVE-2026-33496) due to cache key confusion in the `oauth2_introspection` authenticator, allowing attackers with a valid token to bypass authentication by reusing it with different introspection URLs.

Oathkeeper authentication-bypass vulnerability cache-poisoning cloud
2r 1t