CVE-2025-69202

CVE-2025-69202 describes an authorization bypass vulnerability in Axios Cache Interceptor versions prior to 1.11.1. This flaw allows incorrect cached responses to be returned when server-side applications use different authentication tokens to call upstream services, leading to unauthorized access to data. The vulnerability arises because the cache key is generated solely from the URL, ignoring critical headers like "Authorization," even when the upstream service specifies "Vary: Authorization." The vulnerability has a CVSS score of 6.5 (MEDIUM), indicating it can be exploited remotely with low complexity and no user interaction, potentially leading to high confidentiality impact. It primarily affects server-side applications that handle requests from multiple users and rely on upstream services that utilize the "Vary" header for cache differentiation. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. Organizations using affected versions are advised to upgrade to 1.11.1 or later to mitigate the risk.