CVE-2026-50202 describes a vulnerability in Steeltoe.Security.Authentication.CloudFoundryBase versions prior to 3.4.0, Steeltoe.Security.Authentication.JwtBearer prior to 4.2.0, and Steeltoe.Security.Authentication.OpenIdConnect prior to 4.2.0. The JWT signing key cache in the TokenKeyResolver class uses the 'kid' (key ID) as the sole cache key without differentiating by authority. This flaw allows a key fetched for one JwtBearer scheme to validate tokens for another scheme when multiple schemes with different identity providers are used in the same application. Additionally, cached keys do not expire, so rotated or revoked keys remain trusted until the application process restarts. The issue is patched in versions 3.4.0, 4.2.0, and 4.2.0 respectively. Workarounds include limiting to one JwtBearer scheme per application or restarting the application after key rotation.

This vulnerability can lead to exposure of resources to the wrong authentication sphere, allowing tokens validated against one identity provider to be accepted by another, potentially enabling unauthorized access. The lack of cache expiration means revoked or rotated keys remain trusted, increasing the window of risk until application restart. The CVSS score of 5.9 (medium severity) reflects the network attack vector, high privileges required, and high impact on confidentiality and integrity without availability impact.

A fix is available in Steeltoe.Security.Authentication.CloudFoundryBase version 3.4.0, Steeltoe.Security.Authentication.JwtBearer version 4.2.0, and Steeltoe.Security.Authentication.OpenIdConnect version 4.2.0. Users should upgrade to these versions to resolve the issue. If immediate upgrade is not feasible, mitigate by configuring only one JwtBearer scheme per application when using different identity providers, or restart the application process after identity provider signing key rotations to clear stale cached keys.