CVE-2026-58425

OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation...

CVE-2026-58425 OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation...

CVE-2026-58425

The provided documents describe a vulnerability in Gitea's OAuth token introspection endpoint. The bug occurs when an introspecting client calls /login/oauth/introspect with a token; the handler authenticates the client, then fetches the token's grant and reassigns the local app variable to the g...