The vulnerability in cedar-java (CVE-2026-55771) involves improper control of code generation (CWE-94) manifested as inverted null/self-reference logic in the EntityIdentifier.equals() method prior to version 4.9.0. This causes the method to return true when comparing to null and false when comparing an entity to itself, leading to incorrect equality evaluations. Although the core authorization logic in Cedar is unaffected, integrators performing their own equality checks on entity identifiers in Java could encounter erroneous behavior. The issue is resolved in cedar-java version 4.9.0.

The vulnerability can cause incorrect equality comparisons in cedar-java integrations, potentially leading to logic errors in applications that rely on these checks. The core authorization decisions computed in Rust from JSON remain unaffected, so the primary security enforcement is not compromised. However, integrators using Java-side equality checks may experience unintended behavior, which could affect application correctness or security depending on usage context.

Upgrade cedar-java to version 4.9.0 or later, where the issue with inverted null/self-reference logic in EntityIdentifier.equals() is fixed. No other mitigations are indicated. Patch status is not explicitly stated in the vendor advisory, but the fix is included in version 4.9.0.