Go/github.com/ory/oathkeeper CVE-2021-32701: high 7.5, EPSS 1.63%

Possible bypass of token claim validation when OAuth2 Introspection caching is enabled

Action: Upgrade github.com/ory/oathkeeper to 0.38.12-beta.1 or later.

go get github.com/ory/oathkeeper@v0.38.12-beta.1

Affected

Fixed versions

Sources

• osv: GHSA-qvp4-rpmr-xwrr
• https://github.com/ory/oathkeeper/security/advisories/GHSA-qvp4-rpmr-xwrr

CVE-2021-32701 · published 2021-06-23T18:00:20Z · modified 2026-09-10T03:49:26.937667723Z · JSON