Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Live reproduction against Gitea 1.26.1 Setup: Gitea 1.26.1 docker stack with two users admin and victim and two OAuth applications owned by different users: Client A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e owner=admin Client B: id=588f778f-4a41-4914-ae01-85d776c369db owner=victim admin runs an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the IntrospectOAuth process. An attacker can access sensitive metadata about tokens issued to other clients by submitting a valid token to the introspection endpoint using their own OAuth application's...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the IntrospectOAuth process. An attacker can access sensitive metadata about tokens issued to other clients by submitting a valid token to the introspection endpoint using their own OAuth application's...