high · 8.8CVE-2026-55771Jul 28, 2026

CVE-2026-55771: CedarJava EntityIdentifier Incorrect Equality Comparison

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

CedarJava's EntityIdentifier.equals() method has its null-check and self-reference-check logic inverted, causing it to return true when compared to null and false when compared to itself, which can…

Packagecom.cedarpolicy:cedar-java
Ecosystemmaven
Affected< 2.3.6
Fixed in2.3.6
CVE-2026-55771: CedarJava EntityIdentifier Incorrect Equality Comparison

The problem

The EntityIdentifier.equals() method in CedarJava before version 4.9 has swapped guard clauses. The null check returns true instead of false, and the self-reference check returns false instead of true.

Cedar authorization decisions computed in Rust are not affected because they serialize entity identifiers to JSON. However, any Java integrator who calls equals() directly on EntityIdentifier objects gets inverted results, which can corrupt set membership tests, cache lookups, deduplication, or hand-rolled access checks that depend on correct object identity semantics.

Proof of concept

A working proof-of-concept for CVE-2026-55771 in com.cedarpolicy:cedar-java, with the exact payload below.

java
// Demonstrates the inverted behavior in vulnerable versions (< 4.9)
EntityIdentifier id = new EntityIdentifier("User", "alice");

// BUG: returns true (should be false)
boolean nullCheck = id.equals(null);

// BUG: returns false (should be true)
boolean selfCheck = id.equals(id);

// Impact example: an integrator-written allow-list check
Set<EntityIdentifier> allowList = new HashSet<>();
allowList.add(id);
// contains() relies on equals(); broken equals() breaks the set lookup
boolean allowed = allowList.contains(id); // may return false for a listed identity

The root cause is a classic copy-paste or review mistake in a hand-written equals() override: the two early-return guard branches are in the wrong order and return the wrong booleans. The correct Java equals() contract requires obj == null to return false and obj == this to return true.

The patch in version 4.9 simply swaps the return values on those two branches, restoring the standard contract.

Because HashSet and HashMap use equals() for bucket collision resolution, a broken equals() silently corrupts any collection-based identity check an integrator builds on top of EntityIdentifier. The CWE-697 (Incorrect Comparison) classification is accurate here.

Public PoC not yet available; payload derived from advisory description of the inverted branch logic.

The fix

Upgrade com.cedarpolicy:cedar-java to version 4.9 or later (Maven/Gradle). For the 2.x line, upgrade to 2.3.6; for the 3.x line, upgrade to 3.4.1. Until upgraded, avoid using EntityIdentifier.equals() in any security-sensitive comparison; compare the underlying entity type and ID strings directly instead.

Reporter not attributed.

References: [1][2][3]

Related research