CVE-2026-118394

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The OAuth2 userinfo endpoint /login/oauth/userinfo incorrectly handled the groups claim by re-parsing the Authorization header as an OAuth2 access token rather than utilizing the scope of the credential used for authentication. If a public-only personal access token or a public-only OAuth2 token was provided via a form field or query parameter, the scope returned as empty. This resulted in the disclosure of the token owner's private organization names, team names, and concealed memberships. This issue does not expose repository content.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.