Web Cache Deception: When Your CDN Caches a Stranger's Account Page
A victim clicks a link to /account/settings/style.css. The router normalizes the unknown suffix and serves the real account page — but the cache layer, keying on .css, stores the personalized response for everyone. Minutes later the attacker fetches the same URL and receives the victim's cached page. Here's how the attack works, how we prove it safely, and the three-layer defense.
2MNY Admin
•
Oct 13, 2026
•
4 min read