CWE-524: Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
Last updated
Overview
Applications may use caches to improve efficiency when communicating with remote entities or performing intensive calculations. A cache maintains a pool of objects, threads, connections, pages, financial data, passwords, or other resources to minimize the time it takes to initialize and access these resources. If the cache is accessible to unauthorized actors, attackers can read the cache and obtain this sensitive information.
Real-world CVEs
38 recorded CVEs are caused by CWE-524 (Use of Cache Containing Sensitive Information). The highest-severity and most recent are shown first. 10 new CWE-524 CVEs have been recorded so far in 2026 (13 in 2025).
- CVE-2025-64762
authkit-nextjs may let session cookies be cached in CDNs
High · CVSS 8.0 · EPSS 24th2025-11-21 - CVE-2026-48901
Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects
High · CVSS 7.5 · EPSS 0th2026-05-26 - CVE-2024-27917
Shopware's session is persistent in Cache for 404 pages