AIKIDO-2026-10465

TL;DR

Affected versions of this package are affected by a type confusion vulnerability in the cedar-go JSON value parser, where JSON objects containing string-valued type and id keys are incorrectly parsed as EntityUID values instead of Record objects, silently dropping all other fields. Because this coercion happens recursively across nested values, Cedar policies that expect record fields may instead evaluate unexpected EntityUID objects, causing expressions to fail and authorization decisions to be computed incorrectly. An attacker able to supply JSON entity data, context, or nested record values can craft objects with type and id keys to strip security-relevant fields during parsing and trigger policy mis-evaluation, potentially bypassing intended authorization checks.