A cross-user request mix-up occurs when software incorrectly associates a request or its response with a different user’s request. This can happen when concurrent or asynchronous processing mishandles request state, such as during an error path, causing data intended for one user to be delivered or applied in another user’s context.
In cyber security, this can undermine confidentiality or integrity without necessarily indicating account takeover. For example, a web server or application that mishandles multiplexed HTTP/2 streams could pair a response with the wrong request. Defenders should apply relevant software fixes, review configurations and error handling, and investigate unusual cross-request behavior. A vulnerability describes a possible risk; evidence is needed before concluding that an actual exposure occurred.