CVE-2026-50202

Name of the Vulnerable Software and Affected Versions Steeltoe.Security.Authentication.CloudFoundryBase versions prior to 3.4.0 Steeltoe.Security.Authentication.JwtBearer versions prior to 4.2.0 Steeltoe.Security.Authentication.OpenIdConnect versions prior to 4.2.0

Description The JWT signing key cache in the TokenKeyResolver function uses kid as the sole cache key without namespacing by authority. In applications utilizing multiple JwtBearer schemes that point to different identity providers, a key retrieved for one scheme may satisfy token validation for another. Furthermore, cached keys lack an expiration mechanism, meaning rotated or revoked keys continue to be trusted until the application process is restarted.

Recommendations Update Steeltoe.Security.Authentication.CloudFoundryBase to version 3.4.0. Update Steeltoe.Security.Authentication.JwtBearer to version 4.2.0. Update Steeltoe.Security.Authentication.OpenIdConnect to version 4.2.0. In multi-scheme deployments, configure only one JwtBearer scheme per application when different identity providers are required. Restart the application process after an identity provider signing key rotation to clear stale cached keys.