CVE-2026-118394

The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...