CVE-2026-50202

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Security.Authentication.CloudFoundryBase prior to version 3.4.0, Steeltoe.Security.Authentication.JwtBearer prior to version 4.2.0, and Steeltoe.Security.Authentication.OpenIdConnect prior to version 4.2.0, the JWT signing key cache in `TokenKeyResolver` uses `kid` as the sole cache key without namespacing by authority. In applications with multiple `JwtBearer` schemes pointing to different identity providers, a key fetched for one scheme can satisfy token validation for another. Additionally, cached keys have no expiration, so rotated or revoked keys remain trusted until the application process restarts. Steeltoe.Security.Authentication.CloudFoundryBase version 3.4.0, Steeltoe.Security.Authentication.JwtBearer version 4.2.0, and Steeltoe.Security.Authentication.OpenIdConnect version 4.2.0 patch the issue. If an immediate upgrade is not possible: In multi-scheme deployments, configure only one `JwtBearer` scheme per application when different identity providers are required; and/or restart the application process after an identity provider signing key rotation to clear stale cached keys.

• CWE-668

• https://github.com/SteeltoeOSS/Steeltoe/commit/04db2ace3b806bfe0260bb7d4bda340f241eff48
• https://github.com/SteeltoeOSS/Steeltoe/commit/17b27b8be546ae3f83a2f6e91d45e0c84c5314b7
• https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-7fqc-p256-7pwj

Published

Jun 17, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50195containerd is an open-source container runtime. Versions pri…9.9
• CVE-2026-50196Steeltoe is an open source project that provides a collectio…7.5
• CVE-2026-50197Skipper is an HTTP router and reverse proxy for service comp…7.8
• CVE-2026-5020A vulnerability was detected in Totolink A3600R 4.1.2cu.5182…9.8
• CVE-2026-50200Steeltoe is an open source project that provides a collectio…7.5
• CVE-2026-50201Steeltoe is an open source project that provides a collectio…6.5
• CVE-2026-50203A path traversal in the SFTP provider (`SFTPHook.retrieve_di…9.1
• CVE-2026-50205System log files output unencrypted SMTP server authenticati…8.2
• CVE-2026-50206Incoming VPN network profile settings fail to process specia…6.8
• CVE-2026-50207The system Binder boundary accepts unverified pass-through A…7.8
• CVE-2026-50208High-risk TrustAllCerts routines disable standard TLS certif…9.4
• CVE-2026-50209Broadcast events allow malicious software to rewrite the dev…7.8