PT-2025-53783 · Unknown+1 · Axios-Cache-Interceptor+2

Kishore03109 · Published 2025-12-29 · Updated 2026-01-05 · CVE-2025-69202

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Axios Cache Interceptor versions prior to 1.11.1

Description Axios Cache Interceptor, a cache interceptor for axios, improperly handles responses with the Vary: Authorization header. Prior to version 1.11.1, the cache key was generated solely from the URL, disregarding request headers like Authorization. This resulted in incorrect cached responses being returned when a server made requests to an upstream service using different authentication tokens, leading to potential authorization bypass. Server-side applications utilizing axios-cache-interceptor to cache requests to upstream services, handling requests from multiple users with differing authentication tokens, and relying on the Vary header for cache differentiation are susceptible. Browser or client-side applications, where each session is tied to a single user, are not affected. The issue arises because the library ignores the Vary header, causing all requests to share the same cache irrespective of authorization. This can lead to the leakage of user data across authenticated sessions. After version 1.11.1, support for the Vary header is enabled by default, including the authorization header value in the cache key.

Recommendations Upgrade to version 1.11.1 or later to benefit from the automatic Vary header support.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-573

CWE-639

CWE-524

Related Identifiers

CVE-2025-69202

GHSA-X4M5-4CW8-VC44

Affected Products

Axios

Axios Cache Interceptor

Axios-Cache-Interceptor

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69202.json · Exploit
• 🔥 https://github.com/arthurfiorette/axios-cache-interceptor/security/advisories/GHSA-x4m5-4cw8-vc44 · Exploit
• https://github.com/arthurfiorette/axios-cache-interceptor/commit/49a808059dfc081b9cc23d48f243d55dfce15f01 · Patch
• https://osv.dev/vulnerability/CVE-2025-69202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69202 · Security Note
• https://osv.dev/vulnerability/GHSA-x4m5-4cw8-vc44 · Vendor Advisory
• https://github.com/arthurfiorette/axios-cache-interceptor · Note
• https://twitter.com/CVEnew/status/2005722938415223158 · Twitter Post
• https://t.me/cveNotify/147758 · Telegram Post
• https://t.me/CVEtracker/40873 · Telegram Post
• https://t.me/cveNotify/147247 · Telegram Post