A vulnerability in azure_security_keyvault_certificates versions 0.9.0 through 1.0.0 and 1.1.0-beta.1 allows caching of an authentication scope from a rejected challenge, leading to potential bearer token and request body disclosure to attacker-controlled endpoints on subsequent requests using the same client.