CVE-2026-14199

On instances using Auth Proxy header authentication ([auth.proxy]) with identity caching enabled (sync_ttl > 0), two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged user's cached session and act as that user for the duration of the cache TTL. Default configurations are not affected.

This vulnerability is rated as having an Important impact because successful exploitation allows an authenticated user to hijack sessions of administrative or privileged accounts, leading to complete compromise of the application. The flaw requires non-default settings where reverse proxy header-based authentication is enabled alongside active identity caching. In standard Red Hat product deployments, header-based proxy authentication is not enabled by default, which substantially limits the attack surface across standard installations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Set [auth.proxy] sync_ttl = 0 to disable the identity cache (identity is then synced on every request), or upgrade to a fixed version: 11.0.0+, 12.4.10+ (12.4.x), 13.0.8+ (13.0.x), 13.1.5+ (13.1.x), or 13.2.1+ (13.2.x and newer — 13.2.0 itself is still vulnerable).