CVE-2026-73208

creationtimestamp| type| source ---|---|--- 2026-08-29 16:03:44+00:00| seen| https://bsky.app/profile/yetikamp.bsky.social/post/3muaavdu4hf2k...

DEBIAN-CVE-2026-73208

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...