CVE-2026-33496

CVE-2026-33496 is a high-severity (CVSS 8.1) authentication bypass vulnerability affecting ORY Oathkeeper versions prior to 26.2.0. This flaw arises from cache key confusion in the `oauth2_introspection` authenticator, enabling an attacker with a valid token for one introspection server to bypass access controls for rules configured with a different server. The vulnerability is network-exploitable with low attack complexity and low privileges, posing a high risk to confidentiality and integrity. There is no evidence of active exploitation or public exploit code, though it has received minor community discussion. Organizations should update to version 26.2.0 or disable caching for `oauth2_introspection` authenticators to mitigate this risk.