OAuth2 Introspection Caching Bypass in Ory Oathkeeper
Summary
GHSA-qvp4-rpmr-xwrr: Possible bypass of token claim validation when OAuth2 Introspection caching is enabled. Affects github.com/ory/oathkeeper versions >= 0.38.0-beta.2, < 0.38.12-beta.1. Fixed in 0.38.12-beta.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ory Oathkeeper is an open-source project written in Go that provides an authentication and authorization proxy for APIs. It allows developers to define rules for access control and authentication using a declarative configuration. Ory Oathkeeper integrates with OAuth2 providers to validate access tokens and enforce security policies. The vulnerability described here affects versions of Ory Oathkeeper up to 0.38.11-beta.1.
Vulnerability Detail
The vulnerability allows for a possible bypass of token claim validation when OAuth2 Introspection caching is enabled. When a request is made to an endpoint that requires a specific scope using an access token granted with that scope, the introspection is valid and the token is cached. However, if a second request is made to an endpoint that requires a different scope before the cache has expired, the introspection will still be valid regardless of whether the token has the proper scopes. This can lead to unauthorized access to protected resources.
How To Fix
Latest published version: v0.40.9 as of 23 Oct 2026
go get github.com/ory/oathkeeper@v0.40.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.38.12-beta.1
This is the first release that contains the fix.
go get github.com/ory/oathkeeper@v0.38.12-beta.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
By default, caching is disabled for the oauth2_introspection authenticator in Ory Oathkeeper. If caching is disabled, this vulnerability does not exist. If you are unable to upgrade to the patched version immediately, you can disable caching as a temporary workaround. This can be done by modifying the Ory Oathkeeper configuration to set the cache option to false for the oauth2_introspection authenticator.
Conclusion
The OAuth2 Introspection Caching Bypass vulnerability in Ory Oathkeeper allows for unauthorized access to protected resources when caching is enabled. It can be fixed by upgrading to version 0.38.12-beta.1 or later. A temporary workaround is to disable caching. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ory/oathkeeper →
FAQ
Ory Oathkeeper is an open-source authentication and authorization proxy for APIs. It provides a way to define access control rules and enforce authentication using OAuth2 providers.
OAuth2 Introspection is a mechanism that allows a resource server to validate access tokens with the authorization server. It provides a way to check the validity and scope of an access token before granting access to protected resources.
When caching is enabled for the oauth2_introspection authenticator in Ory Oathkeeper, the vulnerability allows for a bypass of token claim validation. If a request is made with an access token that has a specific scope and the introspection is valid, the token is cached. If a second request is made with a different scope before the cache expires, the introspection will still be valid, allowing unauthorized access to protected resources.
The vulnerability can be fixed by upgrading to version 0.38.12-beta.1 or any subsequent version of Ory Oathkeeper. It is recommended to update to the latest stable release to ensure the security of your application.
Yes, a temporary workaround is to disable caching for the oauth2_introspection authenticator in Ory Oathkeeper. This can be done by modifying the configuration to set the cache option to false for the oauth2_introspection authenticator.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/oathkeeper.
