CVE-2026-50202 Details
Description
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Security.Authentication.CloudFoundryBase prior to version 3.4.0, Steeltoe.Security.Authentication.JwtBearer prior to version 4.2.0, and Steeltoe.Security.Authentication.OpenIdConnect prior to version 4.2.0, the JWT signing key cache in `TokenKeyResolver` uses `kid` as the sole cache key without namespacing by authority. In applications with multiple `JwtBearer` schemes pointing to different identity providers, a key fetched for one scheme can satisfy token validation for another. Additionally, cached keys have no expiration, so rotated or revoked keys remain trusted until the application process restarts. Steeltoe.Security.Authentication.CloudFoundryBase version 3.4.0, Steeltoe.Security.Authentication.JwtBearer version 4.2.0, and Steeltoe.Security.Authentication.OpenIdConnect version 4.2.0 patch the issue. If an immediate upgrade is not possible: In multi-scheme deployments, configure only one `JwtBearer` scheme per application when different identity providers are required; and/or restart the application process after an identity provider signing key rotation to clear stale cached keys.
A vulnerability exists in Steeltoe libraries handling JWT authentication, specifically in Steeltoe.Security.Authentication.CloudFoundryBase versions prior to 3.4.0, Steeltoe.Security.Authentication.JwtBearer versions prior to 4.2.0, and Steeltoe.Security.Authentication.OpenIdConnect versions prior to 4.2.0. The issue arises because the JWT signing key cache in the 'TokenKeyResolver' class uses the 'kid' header as the only cache key without distinguishing between different authorities. In applications with multiple 'JwtBearer' schemes linked to different identity providers, a key retrieved for one scheme can be incorrectly used to validate tokens for another. Furthermore, the cached keys do not expire, meaning that rotated or revoked keys remain valid until the application is restarted.
Users can upgrade to Steeltoe.Security.Authentication.CloudFoundryBase version 3.4.0, Steeltoe.Security.Authentication.JwtBearer version 4.2.0, or Steeltoe.Security.Authentication.OpenIdConnect version 4.2.0. In multi-scheme deployments, if an immediate upgrade is not possible, configure only one 'JwtBearer' scheme per application when different identity providers are required, and restart the application process after an identity provider's signing key is rotated to clear the cached keys.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 17, 2026CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-668 | Exposure of Resource to Wrong Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Steeltoe.Security.Authentication.CloudFoundryBase | <= 3.3.0 (semver) |
CPE
Remediation
| |
| Steeltoe.Security.Authentication.JwtBearer | <= 4.1.0 (semver) |
CPE
Remediation
| |
| Steeltoe.Security.Authentication.OpenIdConnect | <= 4.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |