CVE-2026-58425

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.2

Description An issue exists where the OAuth token introspection endpoint allows any authenticated OAuth client to retrieve metadata for tokens issued to other clients, violating RFC 7662 section 4. The server fails to verify if the requesting client is the intended audience of the token, returning sensitive information regardless of ownership.

API Endpoints: '/login/oauth/introspect' Vulnerable Parameters or Variables: token Function Names: IntrospectOAuth()

An attacker with a valid OAuth client can use this endpoint as a token-validity oracle to verify if stolen tokens are active without triggering audit trails of actual token use. Additionally, it allows for cross-tenant metadata enumeration, enabling an attacker to identify the username and scope associated with tokens belonging to other clients.

Recommendations Update Gitea to a version where the IntrospectOAuth() function is patched to verify that the grant.ApplicationID matches the requesting client's app.ID before returning token metadata. As a temporary workaround, restrict access to the '/login/oauth/introspect' endpoint to trusted clients only.