CVE-2026-50202Medium· 5.9▾ SunlitSteeltoe's static JWKS cache shared across schemes and never invalidated
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
The JWT signing key cache in TokenKeyResolver uses kid as the sole cache key without namespacing by authority. In applications with multiple JwtBearer schemes pointing to different identity providers, a key fetched for one scheme can satisfy token validation for another. Additionally, cached keys have no expiration, so rotated or revoked keys remain trusted until the application process restarts.
In multi-scheme deployments, an attacker who controls one identity provider's signing key can forge tokens accepted by other schemes within the same application. For all applications using TokenKeyResolver, a signing key removed from the identity provider's JWKS endpoint remains trusted indefinitely.
If an immediate upgrade is not possible:
JwtBearer scheme per application when different identity providers are required.Steeltoe.Security.Authentication.JwtBearer <= 4.1.0Steeltoe.Security.Authentication.OpenIdConnect <= 4.1.0Steeltoe.Security.Authentication.CloudFoundryBase <= 3.3.0Upgrade to a patched release:
Steeltoe.Security.Authentication.JwtBearer 4.2.0Steeltoe.Security.Authentication.OpenIdConnect 4.2.0Steeltoe.Security.Authentication.CloudFoundryBase 3.4.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-75523Medium· 5.9Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications
CVE-2022-38474Medium· 4.3A website that had permission to access the microphone could record audio without the audio notification being shown
CVE-2026-50194High· 8.2Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
CVE-2026-50196High· 7.5Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch
CVE-2026-50200High· 7.5Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
CVE-2026-50201Medium· 6.5Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission