CVE-2026-33496 - Vulnerability Analysis

Overview

ORY Oathkeeper < 26.2.0 contains an authentication bypass caused by cache key confusion in oauth2_introspection authenticator, letting attackers with a valid token bypass authentication for different introspection servers, exploit requires multiple configured introspection servers and caching enabled.

Severity & Score

Impact

Attackers with a valid token can bypass authentication for different introspection servers, potentially gaining unauthorized access.

Mitigation

Update to version 26.2.0 or later, or disable caching for oauth2_introspection authenticators.

References

• https://github.com/ory/oathkeeper/commit/198a2bc82a99e0a77bd0ffe290cbdd5285a1b17c
• https://github.com/ory/oathkeeper/security/advisories/GHSA-4mq7-pvjg-xp2r

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 26, 2026

🟠 CVE-2026-33496 - High (8.1) ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to authentication bypass due to cache key confusion. The `oaut... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33496/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner