This vulnerability in Elastic Kibana arises from improper validation of expiration timestamps for time-bounded access tokens. Due to a logic error, tokens remain usable beyond their expiration, allowing unauthorized information disclosure by unauthenticated actors who have the expired token. The issue affects Kibana versions 8.0.0 and 9.0.0. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No patch or official remediation level has been provided by Elastic as of the publication date.

An unauthenticated attacker in possession of an expired time-bounded access token can retrieve information that should no longer be accessible, resulting in unauthorized information disclosure. There is no impact on integrity or availability reported. The vulnerability does not require privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting token distribution and monitoring for unauthorized use of expired tokens. No vendor advisory or official remediation instructions have been provided at this time.