https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T18:05:48.132839+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-42763 EUVD-2026-42763 2026-10-04T18:05:48.136158+00:00 EUVD-2026-42763 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15223 fkie_cve-2020-15223 2026-10-04T18:05:48.136216+00:00

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. This is fixed in version 0.34.0

 https://cve.radiocsirt.org/vuln/ghsa-7mqr-2v3q-v2wm GHSA-7mqr-2v3q-v2wm — Ory fosite contains Improper Handling of Exceptional Conditions 2026-10-04T18:05:48.136270+00:00

Affected: Go: github.com/ory/fosite

### Impact The `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store.

### References [RFC 7009](https://tools.ietf.org/html/rfc7009#section-2.2.1) states that a 503 HTTP code must be returned when the server has a problem.

 https://cve.radiocsirt.org/vuln/gsd-2020-15223 gsd-2020-15223 2026-10-04T18:05:48.136314+00:00 gsd-2020-15223