The CVSS 5.3 score for CVE-2026-71468 fundamentally mischaracterizes the actual risk. This is not a simple information disclosure vulnerability — it's an authentication context propagation flaw that crosses a federated trust boundary, creating conditions for authorization bypass in external systems you don't control.
The core issue: when getFederationConfig refreshes its cache, a single user's bearer token gets frozen into that cache layer and then used to authenticate every subsequent federated request from every user until the cache TTL expires. This means the authentication identity of one user is being applied to requests initiated by completely different users. The federated calls go to remote managed hubs that have their own authorization models expecting requests authenticated as the actual requesting user. Instead, those remote systems receive requests authenticated as whoever's token happened to populate the cache — a valid token, but the wrong identity.
This is an authorization bypass propagating across a trust boundary, not information disclosure. The remote hub's authorization decisions become systematically unreliable for the entire TTL window because it's making permission choices based on the wrong identity. The contamination isn't contained to the caching layer — it flows into every federated endpoint in the relationship.
Key defensive actions: First, determine your cache TTL for getFederationConfig and whether an authenticated user can forcibly refresh it to plant a specific token. Second, audit whether your federated remote hubs instrument the correlation between the user who triggered the request and the user identity represented by the token — most don't, and exploitation leaves no obvious forensic trail. Third, examine whether the federation architecture actually requires bearer tokens flowing through this layer, or if delegated trust patterns could eliminate this entire attack surface.
The low EPSS (0.00191) likely reflects that exploitation requires legitimate authenticated access through normal application flows, which masks how widespread the exposure is in multi-tenant environments where many users share the federated infrastructure.