CVE-2026-67310 is a tenant isolation failure in identity management software that was patched in version 1.27.0. The vulnerability stems from a realm validation loop using HashSet iteration order, which is non-deterministic in Java. When processing cross-tenant asset link requests, the code checks realm membership by iterating over a client-supplied HashSet—but HashSet provides no ordering guarantees, meaning the validation may succeed or fail depending on iteration order. This isn't a random coin flip from the attacker's perspective: they can observe which realm 'wins' through API response differences, allowing targeted exploitation rather than blind retries.
The CVSS 5.4 rating severely understates the risk. An attacker with valid credentials in any tenant can exploit this with trivial automation—there's no meaningful constraint beyond script execution. More critically, the cross-tenant link persistence transforms this from a one-time disclosure into a persistent exfiltration channel. Once an attacker persists a link to a victim's asset through the vulnerable window, that link remains functional indefinitely, delivering formula field data on every GET request. The attacker gains recurring access to cross-tenant asset metadata without needing to re-exploit the HashSet bug.
The 1.27.0 patch makes iteration deterministic, but this is a symptom fix, not a root cause correction. The architectural pattern—accepting client-supplied multi-realm collections for security-critical validation—remains intact elsewhere in the codebase. Organizations should audit for similar patterns: loops over non-deterministic collections used for access control, particularly around cross-tenant asset operations. Also audit which @Formula fields are exposed through asset links, since these derived fields often contain sensitive calculated values that developers treat as metadata but which constitute real data exposure when leaked across tenant boundaries.