Cyber Resilience

CVE-2025-69202

Access Control in Axios-Cache-Interceptor Axios Cache Interceptor ≤ 1.11.1

Public PoCAccess Control
Published
29 December 2025
Modified
05 January 2026
Patch / advisory
View advisory
CVSS Score v4 6.0
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0028 20th percentile
Risk Priority 27 floored blend · peak EPSS

Summary

CVE-2025-69202 is a medium-severity Use of Cache Containing Sensitive Information (CWE-524) vulnerability in Axios-Cache-Interceptor Axios Cache Interceptor. Its CVSS base score is 6.0 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass. The cache key is generated only from…

more

the URL, ignoring request headers like `Authorization`. When the server responds with `Vary: Authorization` (indicating the response varies by auth token), the library ignores this, causing all requests to share the same cache regardless of authorization. Server-side applications (APIs, proxies, backend services) that use axios-cache-interceptor to cache requests to upstream services, handle requests from multiple users with different auth tokens, and upstream services replies on `Vary` to differentiate caches are affected. Browser/client-side applications (single user per browser session) are not affected. Services using different auth tokens to call upstream services will return incorrect cached data, bypassing authorization checks and leaking user data across different authenticated sessions. After `v1.11.1`, automatic `Vary` header support is now enabled by default. When server responds with `Vary: Authorization`, cache keys now include the authorization header value. Each user gets their own cache.

CWE(s)
CWE-524CWE-573CWE-639

Related Threats

MITRE ATT&CK Enterprise Techniques

T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-49858Shared CWE-524, CWE-639
CVE-2026-61836Shared CWE-524, CWE-639
CVE-2025-14806Shared CWE-524
CVE-2026-53943Shared CWE-524
CVE-2026-41841Shared CWE-524
CVE-2026-25540Shared CWE-524
CVE-2026-65755Shared CWE-524
CVE-2024-45596Shared CWE-524
CVE-2025-4233Shared CWE-524
CVE-2023-37517Shared CWE-524

Affected Assets

axios-cache-interceptor
axios cache interceptor
≤ 1.11.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V14.3.2

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Enforcing approved authorizations on every access request structurally stops a user-controlled key from reaching another user's data.

AC-24 Access Control Decisions good match

Requiring explicit access-control decisions on each request blocks unauthorized key-driven access.

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover cases where callers fail to follow required specifications or APIs.

SC-4 Information in Shared System Resources good match

Directly prevents unauthorized transfer of information through shared resources such as caches.

AC-4 Information Flow Enforcement partial match

Controls information flows to keep sensitive data from leaving its authorized control sphere via caches.

AC-6 Least Privilege partial match

Least-privilege restrictions limit the scope of data reachable even if a key check is bypassed.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.

PR.DS-01 mostly match
prevents

Protecting confidentiality of data-at-rest covers caches that persist sensitive information.

PR.IR-01 mostly match
prevents

Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce correct adherence to language, framework, protocol and platform specifications during implementation.

PR.DS-10 partial match
prevents

Protecting data-in-use can mitigate exposure when caches hold transient sensitive values.

PR.PS-01 partial match
prevents

Hardened configuration baselines can disable or secure caching of sensitive data.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.12 Data leakage prevention mostly match
prevents

Data leakage prevention can block unauthorized access to cached sensitive information.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect specification non-compliance but does not itself prevent the weakness.

A.8.3 Information access restriction mostly match
prevents

Information access restriction directly limits who can read cached sensitive data.

A.5.15 Access control partial match
prevents

Access control policy directly requires enforcement of authorization rules that prevent unauthorized access via manipulated keys.

A.5.18 Access rights partial match
prevents

Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.

A.8.10 Information deletion partial match
mitigates

Information deletion ensures sensitive data is removed from caches when no longer needed.

References