This vulnerability involves a race condition (CWE-362) in the shared API-key authentication mechanism of Extreme Platform ONE's IAM Gateway. When multiple concurrent requests occur, improper synchronization can cause data leakage between tenants, allowing an authenticated request to receive data intended for a different tenant. The flaw was confirmed on ExtremeCloud IQ/XIQ API endpoints and Extreme Platform ONE/Common Services API paths. Other authentication methods such as XIQ-native tokens and OAuth/Bearer JWT are unaffected. There is no vendor-provided patch or official remediation level indicated, and no known exploits in the wild have been reported.

The vulnerability can lead to unauthorized disclosure of tenant data due to improper synchronization in the API-key authentication path. This could expose sensitive information across tenants in a multi-tenant environment. Integrity and availability are not impacted. The medium CVSS score (6.3) reflects the confidentiality impact under specific high-concurrency conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Extreme Networks advisories for updates. No vendor guidance indicates that the issue is already mitigated or requires no action. Until a patch is available, consider limiting high-concurrency API key usage or segregating sensitive tenants if feasible.