Authorization Bypass Vulnerability in Axios Cache Interceptor by Arthur Fiorette

CVE-2025-69202

What is CVE-2025-69202?

The Axios Cache Interceptor, before version 1.11.1, contains a vulnerability where it fails to account for differing authorization tokens when caching responses from upstream services. Specifically, the cache key is based solely on the URL, disregarding critical request headers like Authorization. This leads to potential authorization bypass, where distinct authenticated users may receive incorrect cached responses as the cache does not differentiate based on authorization. The server’s Vary: Authorization response header is ignored, resulting in a shared cache across sessions that should remain separate. After the update to v1.11.1, proper handling of the Vary header is implemented, ensuring cache segregation based on the authorization provided.

References