CVE-2026-68481 Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...

CVE-2026-68481

Apache CXF is vulnerable to improper authorization due to a flaw in the DefaultEncryptingOAuthDataProvider process. This issue allows revoked access and refresh tokens to remain valid and be reported as active by the TokenIntrospectionService, bypassing intended revocation processes and potential...

EUVD-2026-53857

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...

CVE-2026-68481 Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...

CVE-2026-68481 Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...

CVE-2026-68481

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...

CVE-2026-18208

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...

CVE-2026-18208

Affected product: Keycloak (keycloak-services OIDC token introspection endpoint). Issue: when a confidential client that expects signed JWT introspection responses inspects a token issued for a different audience, the endpoint still returns the full set of token claims inside a signed JWT field e...

CVE-2026-18208 Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...

EUVD-2026-51482

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...

CVE-2026-18208 Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...

CVE-2026-18208

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...

CVE-2026-18208

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...

SUSE CVE-2026-11717

An authentication bypass vulnerability exists in the generic opaque token validation path validateOpaqueToken of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint RFC 7662, the toolbox decodes the response into an introspectResp struct where t...

PT-2026-66724

Name of the Vulnerable Software and Affected Versions keycloak-services affected versions not specified Description A flaw exists in the OIDC token introspection endpoint of the keycloak-services component. The issue occurs when a confidential client, configured to receive signed JWT JSON Web Tok...

CVE-2026-18208: Missing Authorization

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the OIDC token introspection endpoint in the keycloak-services component. An...

GO-2026-6079 Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) in gitea.dev

Gitea: OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation in gitea.dev...

PT-2026-65376

Gitea: OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation in gitea.dev...

GHSA-VXV2-8J6R-PCPG Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Live reproduction against Gitea 1.26.1 Setup: Gitea 1.26.1 docker stack with two users admin and victim and two OAuth applications owned by different users: Client A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e owner=admin Client B: id=588f778f-4a41-4914-ae01-85d776c369db owner=victim admin runs an...