CVE-2026-33496 - Vulnerability Analysis

Overview

ORY Oathkeeper < 26.2.0 contains an authentication bypass caused by cache key confusion in oauth2_introspection authenticator, letting attackers with a valid token bypass authentication for different introspection servers, exploit requires multiple configured introspection servers and caching enabled.

Severity & Score

Impact

Attackers with a valid token can bypass authentication for different introspection servers, potentially gaining unauthorized access.

Mitigation

Update to version 26.2.0 or later, or disable caching for oauth2_introspection authenticators.

References

• https://github.com/ory/oathkeeper/commit/198a2bc82a99e0a77bd0ffe290cbdd5285a1b17c
• https://github.com/ory/oathkeeper/security/advisories/GHSA-4mq7-pvjg-xp2r

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner