---
id: CVE-2026-50202
title: Steeltoe's static JWKS cache shared across schemes and never invalidated
summary: Steeltoe's static JWKS cache shared across schemes and never invalidated
severity: medium
cvss: 5.9
cwe:
  - CWE-668
vendor: Steeltoe
product: Steeltoe.Security.Authentication.JwtBearer
ecosystem: nuget
affected:
  - Steeltoe.Security.Authentication.JwtBearer <= 4.1.0
  - Steeltoe.Security.Authentication.OpenIdConnect <= 4.1.0
  - Steeltoe.Security.Authentication.CloudFoundryBase <= 3.3.0
patched:
  - Steeltoe.Security.Authentication.JwtBearer 4.2.0
  - Steeltoe.Security.Authentication.OpenIdConnect 4.2.0
  - Steeltoe.Security.Authentication.CloudFoundryBase 3.4.0
published: '2026-07-02'
updated: '2026-07-02'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-7fqc-p256-7pwj'
references:
  - url: >-
      https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-7fqc-p256-7pwj
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50202'
  - url: >-
      https://github.com/SteeltoeOSS/Steeltoe/commit/04db2ace3b806bfe0260bb7d4bda340f241eff48
  - url: >-
      https://github.com/SteeltoeOSS/Steeltoe/commit/17b27b8be546ae3f83a2f6e91d45e0c84c5314b7
  - url: 'https://github.com/advisories/GHSA-7fqc-p256-7pwj'
tags:
  - ghsa
  - nuget
epss: 0.00474
epssPercentile: 0.38371
ingestedAt: '2026-07-02T20:42:45.627Z'
---

## Overview

### Summary

The JWT signing key cache in `TokenKeyResolver` uses `kid` as the sole cache key without namespacing by authority. In applications with multiple `JwtBearer` schemes pointing to different identity providers, a key fetched for one scheme can satisfy token validation for another. Additionally, cached keys have no expiration, so rotated or revoked keys remain trusted until the application process restarts.

### Impact

In multi-scheme deployments, an attacker who controls one identity provider's signing key can forge tokens accepted by other schemes within the same application. For all applications using `TokenKeyResolver`, a signing key removed from the identity provider's JWKS endpoint remains trusted indefinitely.

### Mitigations

If an immediate upgrade is not possible:

- In multi-scheme deployments, configure only one `JwtBearer` scheme per application when different identity providers are required.
- Restart the application process after an identity provider signing key rotation to clear stale cached keys.

## Affected packages

- `Steeltoe.Security.Authentication.JwtBearer <= 4.1.0`
- `Steeltoe.Security.Authentication.OpenIdConnect <= 4.1.0`
- `Steeltoe.Security.Authentication.CloudFoundryBase <= 3.3.0`

## Remediation

Upgrade to a patched release:

- `Steeltoe.Security.Authentication.JwtBearer 4.2.0`
- `Steeltoe.Security.Authentication.OpenIdConnect 4.2.0`
- `Steeltoe.Security.Authentication.CloudFoundryBase 3.4.0`