Threats affecting pkg:nuget/SteeltoeOSS/steeltoe.security.authentication.openidconnect

A vulnerability in Steeltoe.Security.Authentication.CloudFoundryBase and related Steeltoe authentication libraries prior to certain versions allows improper caching of JWT signing keys. The cache uses the 'kid' value without namespacing by authority, causing keys from one identity provider to be incorrectly trusted for another in multi-scheme applications. Cached keys also do not expire, so revoked or rotated keys remain trusted until the application restarts. Fixed versions address this issue by properly namespacing and managing cache expiration.