The vulnerability arises from the HttpTransferCache utility in @angular/common, which caches HTTP responses during SSR to optimize hydration. When a child HttpClient delegates requests to a parent client using withRequestsMadeViaParent(), the child evaluates cache eligibility before the parent injects authentication credentials. If the child sees the request as anonymous, it caches the response even if the parent later authenticates the request and the response contains sensitive data. This cached response can be embedded in SSR HTML and served to other users if shared caching layers are used. The flaw is addressed by updating @angular/common to run root interceptors only in the parent chain, ensuring cache eligibility is evaluated after authentication headers are added.

Exploitation can lead to leakage of sensitive, user-specific information to unauthorized users. Specifically, authenticated response data may be cached in SSR HTML pages and served to other users via shared caches such as CDNs or reverse proxies, violating confidentiality.

A patch is available in @angular/common versions 22.1.1, 21.2.20, and 20.3.28 that resolves the issue by adjusting interceptor execution order. Applications should upgrade to these versions to remediate the vulnerability. For those unable to upgrade immediately, mitigations include attaching authentication credentials directly on the child HttpClient or applying explicit cache filters on the child client to exclude sensitive endpoints from caching.