PT-2026-117593

Summary The API-key cache in check apikey allows an attacker to authenticate with a forged API key as long as the legitimate key for the same key id has been used recently. On a cache hit, the API key secret is never verified, resulting in a complete authentication bypass during the cache lifetim...