RUSTSEC-2026-0437

Affected versions of KeyVaultAuthorizer::on_challenge cache the authentication scope from a WWW-Authenticate response before verifying that the challenge resource matches the requested endpoint. When verification rejects the challenge, the scope remains cached. A subsequent request through the same client uses that scope to authorize the request without repeating challenge resource verification.

For azure_security_keyvault_certificates, the affected versions are 0.9.0 through 1.0.0, inclusive, and 1.1.0-beta.1. Versions before 0.9.0 do not use this challenge-scope cache and are unaffected by this issue.

Impact

An application that sends requests to an attacker-controlled endpoint and reuses the same client after a rejected challenge can disclose a bearer token and request body to that endpoint, if its credential can obtain a token for the supplied scope. The first request's validation error therefore does not prevent disclosure on a later request. Changing the request origin between requests is not required.

Fix

Update to 1.0.1 on the stable release line or 1.1.0-beta.2 on the preview release line.

The fix caches the scope only after challenge resource verification succeeds when verification is enabled. Rejected challenges no longer populate the cache. The existing option to disable challenge resource verification is unchanged; this fix does not add exact-origin binding.