CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-69202

The Shared Hallucination: Authorization Bypass in axios-cache-interceptor

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 1, 2026·6 min read·38 visits

Executive Summary (TL;DR)

The popular library 'axios-cache-interceptor' (< 1.11.1) failed to respect the HTTP 'Vary' header. This effectively treats authenticated responses as global public assets. If an Admin visits a page, the library caches it. If a Guest visits the same page immediately after, they get the Admin's cached view, bypassing backend authentication checks entirely.

A critical failure in cache key generation allows unprivileged users to inherit the sessions of privileged users in server-side implementations of axios-cache-interceptor.

Official Patches

axios-cache-interceptorGitHub Commit fixing the issue

Fix Analysis (1)

Technical Appendix

CVSS Score
6.5/ 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Probability
0.04%
Top 100% most exploited

Affected Systems

Node.js Backend-for-Frontends (BFF)SSR Applications (Next.js/Nuxt.js using custom axios instances)API Proxies using axios-cache-interceptor

Affected Versions Detail

Product
Affected Versions
Fixed Version
axios-cache-interceptor
Arthur Fiorette
< 1.11.11.11.1
AttributeDetail
CWE IDCWE-524 (Sensitive Information in Cache)
Attack VectorNetwork (AV:N)
ImpactConfidentiality High, Authorization Bypass
CVSS Score6.5 (Medium)
Exploit StatusPoC Available (in unit tests)
Fix Version1.11.1

MITRE ATT&CK Mapping

T1557Adversary-in-the-Middle
Credential Access
T1213Data from Information Repositories
Collection
CWE-524
Information Disclosure via Cache

Use of Cache Containing Sensitive Information

Known Exploits & Detection

GitHubIntegration tests demonstrating cache collision fixes for Vary headers

Vulnerability Timeline

Patch Committed
2025-02-12
GHSA Advisory Published
2025-02-14

References & Sources

  • [1]GHSA-x4m5-4cw8-vc44
  • [2]NVD Entry

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 1 hour ago•GHSA-X445-F3H2-J279
7.5

GHSA-X445-F3H2-J279: OAuth Provider Confusion in Auth.js and NextAuth.js

A critical logical security flaw exists in Auth.js (formerly NextAuth.js) where signed anti-CSRF check cookies (state, nonce, and PKCE code_verifier) are not bound to the specific Identity Provider that initiated the authorization flow. In multi-provider environments, this allows an attacker to replay valid, cryptographically signed cookies minted during a flow with one provider against a callback handling a different provider. This vulnerability can lead to session hijacking, identity theft, or unauthorized account linking.

Alon Barad
Alon Barad
3 views•7 min read
•about 2 hours ago•GHSA-7RQJ-J65F-68WH
8.1

GHSA-7RQJ-J65F-68WH: Account Takeover via Homoglyph Bypass in NextAuth.js Email Normalization

A security vulnerability in the email normalization logic of NextAuth.js and Auth.js allows remote attackers to bypass email validation constraints and achieve Account Takeover (ATO) through Unicode homoglyph smuggling. Under standard conditions, Unicode compatibility characters represent visually similar symbols that are normalized downstream to ASCII equivalents, facilitating structural validation bypasses. This issue specifically affects passwordless email authentication flows.

Alon Barad
Alon Barad
4 views•6 min read
•about 3 hours ago•GHSA-XMF8-CVQR-RFGJ
7.5

GHSA-XMF8-CVQR-RFGJ: Denial of Service via Uncaught Exception and Session Confusion in Auth.js

Auth.js (formerly NextAuth.js) contains a denial of service vulnerability due to an uncaught URIError in the getToken() token parser when processing malformed percent-encoded sequences in bearer tokens. Additionally, the library was vulnerable to session state confusion and replay attacks because OAuth check cookies (state, nonce, and PKCE) were not properly bound to specific providers, permitting cross-provider token reuse.

Amit Schendel
Amit Schendel
3 views•6 min read
•about 4 hours ago•CVE-2026-53467
5.3

CVE-2026-53467: Heap Information Disclosure via Uninitialized Pixel Cache in ImageMagick MNG Decoder

CVE-2026-53467 is a heap information disclosure vulnerability in the Multiple-image Network Graphics (MNG) decoder of ImageMagick. The vulnerability arises from a failure to zero-initialize newly allocated pixel cache memory buffers. A remote attacker can exploit this by submitting a crafted sparse MNG image file to trigger uninitialized memory preservation. The resulting output contains residual heap bytes, potentially leaking sensitive process memory or assisting in ASLR bypass.

Amit Schendel
Amit Schendel
5 views•6 min read
•about 5 hours ago•CVE-2026-55223
6.3

CVE-2026-55223: Remote Code Execution via Deserialization Gadget Chain in c3p0 Connection Pooling Library

An untrusted deserialization vulnerability exists in the c3p0 JDBC connection pooling library before version 0.14.0. Standard JDBC getter methods conform to the JavaBean property getter pattern, allowing introspection libraries like Apache Commons BeanUtils to evaluate connection properties dynamically during deserialization, leading to arbitrary code execution when chained with a vulnerable database driver or JNDI sink.

Alon Barad
Alon Barad
5 views•6 min read
•about 6 hours ago•CVE-2026-54696
3.7

CVE-2026-54696: Heap-based Buffer Overflow in Ruby json Gem Native C Extension

A heap-based buffer overflow vulnerability exists in the native C extension of the Ruby json gem (versions 2.9.0 through 2.19.8) during IO-based streaming serialization. An incorrect buffer size calculation can lead to memory corruption and process termination when processing large strings.

Alon Barad
Alon Barad
6 views•6 min read