OAuth Token Introspection Metadata Exposure

Executive Summary

CVE-2026-58425 is a vulnerability in Gitea where the OAuth token introspection endpoint returns metadata of tokens issued to other clients. This violates RFC 7662 section 4, which requires token information to only be disclosed to authorized clients. The issue occurs because the introspection handler does not verify if the requesting client matches the token's intended audience before returning sensitive details like token status, scope, username, and JWT claims.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Gitea logs for unusual OAuth token introspection requests. Look for patterns where clients request metadata of tokens not issued to them. Verify if the introspection endpoint returns sensitive details like token status, scope, or JWT claims for tokens not belonging to the requesting client.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid OAuth credentials can exploit this to enumerate metadata of tokens belonging to other clients, including cross-tenant tokens, without consuming or using them. This enables scenarios like stolen-token validation, cross-tenant reconnaissance, and token-confusion mapping.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later to apply the patch. If immediate upgrade is not possible, restrict access to the OAuth token introspection endpoint by network policies or firewall rules. Review and audit OAuth token metadata exposure in logs to identify potential exploitation attempts.

Useful 0 Not Useful 0