Rebelarch

**Name of the Vulnerable Software and Affected Versions** Grafana (affected versions not specified) **Description** Self-managed instances using Auth Proxy authentication with identity caching enabled (where `sync ttl` is greater than zero) are susceptible to an authentication bypass. The issue occurs because the Auth Proxy cache key concatenates the username and forwarded identity attributes without a delimiter, allowing distinct identities to collide on a single key. An authenticated user can spoof a higher-privileged user, including an Administrator, by shaping their own attributes to collide with a live cache entry of the target user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.