{"id":"CVE-2026-58425","aliases":["EUVD-2026-58154","GHSA-vxv2-8j6r-pcpg","GO-2026-6079","SUSE-SU-2026:23216-1","SUSE-SU-2026:23227-1","openSUSE-SU-2026:21551-1"],"status":"published","title":"OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)","description":"OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00331,"percentile":0.26628,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-863"],"published":"2026-07-21T20:21:33Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Go","package":"code.gitea.io/gitea","fixed_in":["1.27.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"gitea.dev","fixed_in":["1.27.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"code.gitea.io/gitea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0"}]}]},{"source":"osv","ecosystem":"Go","package":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.0"}]}]},{"source":"osv","ecosystem":"Go","package":"gitea.dev","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77}],"products":[{"vendor":"gitea","product":"gitea open source git server"}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-vxv2-8j6r-pcpg","tags":["vendor-advisory","exploit","advisory","web"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0","tags":["release-notes","advisory","web"]},{"url":"https://blog.gitea.com/gitea-1.27.0-is-released/","tags":["release-notes","advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/38042","tags":["web"]},{"url":"https://github.com/go-gitea/gitea/commit/c9920b7bd0f6ec1f7590f104711b09d55917f9e8","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vxv2-8j6r-pcpg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58425.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58425","tags":["advisory"]},{"url":"https://github.com/go-gitea/gitea","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623216-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8276","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623227-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-58425","title":"OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)","description":"OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)","status":"published","published":"2026-08-13T16:44:47.902Z","modified":"2026-08-14T17:33:14.15Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200","CWE-863"],"updated_at":"2026-11-02T13:47:28.691429Z"}],"euvd":[{"id":"EUVD-2026-58154","description":"OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)","status":"published","published":"2026-08-13T16:44:47Z","modified":"2026-08-14T17:33:14Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:53.90055Z"}],"ghsa":[{"id":"GHSA-vxv2-8j6r-pcpg","title":"Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)","description":"## Live reproduction against Gitea 1.26.1\n\nSetup: Gitea 1.26.1 docker stack with two users (`admin` and `victim`) and two OAuth applications owned by different users:\n\n```\nClient A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e   owner=admin\nClient B: id=588f778f-4a41-4914-ae01-85d776c369db   owner=victim\n```\n\n`admin` runs an OAuth flow against Client A and obtains an access token. `victim` (acting through Client B's credentials) calls the introspection endpoint with Client A's access token in the body:\n\n```\n$ curl -s -u \"$B_ID:$B_SEC\" -X POST http://localhost:3001/login/oauth/introspect \\\n       --data-urlencode \"token=$CLIENT_A_ACCESS_TOKEN\"\n{\n    \"active\": true,\n    \"username\": \"admin\",\n    \"iss\": \"http://localhost:3001\",\n    \"sub\": \"1\",\n    \"aud\": [\n        \"5dda747d-7fdd-4694-85ff-ce4f893ce51e\"\n    ]\n}\n```\n\nNote the `aud` claim: the server explicitly states the token's audience is Client A, yet returns the full metadata to Client B. Per RFC 7662 section 4 (\"The authorization server SHOULD also limit the information it discloses about each token to the resources that are authorized to receive it\") the introspection result must not be disclosed to clients other than the token's audience.\n\nFull reproduction script attached as `poc.sh`. Full session log attached as `live_run.log`.\n\n## Root cause\n\n`routers/web/auth/oauth2_provider.go:130-175` `IntrospectOAuth`:\n\n```go\nfunc IntrospectOAuth(ctx *context.Context) {\n    clientIDValid := false\n    authHeader := ctx.Req.Header.Get(\"Authorization\")\n    if parsed, ok := httpauth.ParseAuthorizationHeader(authHeader); ok \u0026\u0026 parsed.BasicAuth != nil {\n        clientID, clientSecret := parsed.BasicAuth.Username, parsed.BasicAuth.Password\n        app, err := auth.GetOAuth2ApplicationByClientID(ctx, clientID)\n        if err != nil \u0026\u0026 !auth.IsErrOauthClientIDInvalid(err) {\n            log.Error(\"Error retrieving client_id: %v\", err)\n            ctx.HTTPError(http.StatusInternalServerError)\n            return\n        }\n        clientIDValid = err == nil \u0026\u0026 app.ValidateClientSecret([]byte(clientSecret))\n    }\n    if !clientIDValid {\n        ctx.Resp.Header().Set(\"WWW-Authenticate\", `Basic realm=\"Gitea OAuth2\"`)\n        ctx.PlainText(http.StatusUnauthorized, \"no valid authorization\")\n        return\n    }\n\n    var response struct {\n        Active   bool   `json:\"active\"`\n        Scope    string `json:\"scope,omitempty\"`\n        Username string `json:\"username,omitempty\"`\n        jwt.RegisteredClaims\n    }\n\n    form := web.GetForm(ctx).(*forms.IntrospectTokenForm)\n    token, err := oauth2_provider.ParseToken(form.Token, oauth2_provider.DefaultSigningKey)\n    if err == nil {\n        grant, err := auth.GetOAuth2GrantByID(ctx, token.GrantID)\n        if err == nil \u0026\u0026 grant != nil {\n            app, err := auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)  // shadows the introspecting client's `app`\n            if err == nil \u0026\u0026 app != nil {\n                response.Active = true\n                response.Scope = grant.Scope\n                response.RegisteredClaims = oauth2_provider.NewJwtRegisteredClaimsFromUser(app.ClientID, grant.UserID, nil)\n            }\n            if user, err := user_model.GetUserByID(ctx, grant.UserID); err == nil {\n                response.Username = user.Name\n            }\n        }\n    }\n\n    ctx.JSON(http.StatusOK, response)\n}\n```\n\nThe handler:\n\n1. Authenticates the introspecting client via HTTP Basic (`app.ValidateClientSecret`). The local variable `app` at this point references the introspecting client.\n2. Loads the grant for `form.Token` via `auth.GetOAuth2GrantByID(ctx, token.GrantID)`.\n3. **Reassigns** `app` to `auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)` (line 162). After this point, `app` is the token's issuing client, not the introspecting client.\n4. Populates `response` from the reassigned `app` and the grant.\n\nThere is no comparison between the introspecting client's id and `grant.ApplicationID`. The endpoint will return metadata for any token whose JWT signature validates, regardless of which client is asking.\n\n## Patch parity with PR #37704\n\nThe same file contains two recently-hardened handlers in commit `7e54514316` (\"fix(oauth): bind token exchanges to the original client request\", PR #37704, 2026-05-15) that added exactly this missing check:\n\n`handleRefreshToken` (routers/web/auth/oauth2_provider.go:561-568):\n\n```go\nif grant.ApplicationID != app.ID {\n    handleAccessTokenError(ctx, oauth2_provider.AccessTokenError{\n        ErrorCode:        oauth2_provider.AccessTokenErrorCodeInvalidGrant,\n        ErrorDescription: \"refresh token belongs to a different client\",\n    })\n    return\n}\n```\n\n`handleAuthorizationCode` (routers/web/auth/oauth2_provider.go:640-647):\n\n```go\nif authorizationCode.RedirectURI != \"\" \u0026\u0026 form.RedirectURI != authorizationCode.RedirectURI {\n    handleAccessTokenError(ctx, oauth2_provider.AccessTokenError{ ... })\n    return\n}\n// later in the same function:\nif authorizationCode.Grant.ApplicationID != app.ID {\n    handleAccessTokenError(ctx, ...)\n    return\n}\n```\n\n`IntrospectOAuth` shares the same problem space (it consumes a token bound to a grant whose application may differ from the requesting client) but did not receive the parallel patch.\n\n## Impact\n\nAny authenticated OAuth client can call `/login/oauth/introspect` with another client's access or refresh token in the body and learn:\n\n* `active` (true or false). A token-validity oracle that survives across application boundaries without consuming or \"using\" the token.\n* `scope`. The scope of the token.\n* `username`. The user the token belongs to.\n* `iss`, `sub`, `aud`. Standard JWT registered claims. `aud` reveals the issuing client_id, making it obvious to the introspecting client that the token does not belong to them. The server returns the data anyway.\n\nPractical scenarios:\n\n1. **Stolen-token validation oracle.** An attacker who exfiltrates an access token from logs, traffic capture, browser memory, or a leaked dump can verify the token is still active before using it for higher-noise actions like API calls. The probe does not consume the grant counter, so it does not appear in audit trails of \"actual token use\".\n2. **Cross-tenant metadata enumeration.** Any user can register their own OAuth application on a Gitea instance (web UI: /user/settings/applications). The attacker uses their own valid credentials to introspect tokens belonging to other tenants' clients. They learn which user/scope each token corresponds to without ever using it.\n3. **Token-confusion reconnaissance.** Before chaining a separate vulnerability (e.g., a future token-replay or session-fixation bug), the attacker can use introspection to map the token universe.\n\n## Suggested remediation\n\nA one-line fix matching the PR #37704 pattern:\n\n```diff\n grant, err := auth.GetOAuth2GrantByID(ctx, token.GrantID)\n if err == nil \u0026\u0026 grant != nil {\n+    if grant.ApplicationID != app.ID {\n+        // do not reveal token metadata for tokens not issued to this client\n+        ctx.JSON(http.StatusOK, response)  // response is zero-valued, active=false\n+        return\n+    }\n     app, err := auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)\n```\n\nOr, equivalently, replace the inner `app` reassignment with a check that uses the introspecting client's `app.ClientID` directly for the response claims.\n\n## Affected versions\n\nConfirmed at Gitea v1.26.1 (latest release, 2026-04-24, docker image `gitea/gitea:1.26.1`). The vulnerable code path has been in place since the introspection endpoint was introduced; the recent PR #37704 / #37706 OAuth hardening landed in master May 15-16 2026 but did not touch this endpoint.\n\n## Attachments\n-  [poc.sh](https://github.com/user-attachments/files/28182098/poc.sh): Full reproduction script.\n-  [live_run.log](https://github.com/user-attachments/files/28182115/live_run.log): Full session log.","status":"published","published":"2026-07-21T20:21:33Z","modified":"2026-07-21T20:21:34Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-863"],"updated_at":"2026-11-02T14:40:50.444681Z"}],"nvd":[{"id":"CVE-2026-58425","description":"OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)","status":"published","published":"2026-08-13T17:17:26.627Z","modified":"2026-08-26T16:53:48.3Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-863"],"updated_at":"2026-11-02T14:12:37.557758Z"}],"osv":[{"id":"CVE-2026-58425","title":"OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)","description":"OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)","status":"published","published":"2026-08-13T16:44:47.902Z","modified":"2026-10-28T02:30:33.800885146Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-863"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"GHSA-vxv2-8j6r-pcpg","title":"Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)","description":"## Live reproduction against Gitea 1.26.1\n\nSetup: Gitea 1.26.1 docker stack with two users (`admin` and `victim`) and two OAuth applications owned by different users:\n\n```\nClient A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e   owner=admin\nClient B: id=588f778f-4a41-4914-ae01-85d776c369db   owner=victim\n```\n\n`admin` runs an OAuth flow against Client A and obtains an access token. `victim` (acting through Client B's credentials) calls the introspection endpoint with Client A's access token in the body:\n\n```\n$ curl -s -u \"$B_ID:$B_SEC\" -X POST http://localhost:3001/login/oauth/introspect \\\n       --data-urlencode \"token=$CLIENT_A_ACCESS_TOKEN\"\n{\n    \"active\": true,\n    \"username\": \"admin\",\n    \"iss\": \"http://localhost:3001\",\n    \"sub\": \"1\",\n    \"aud\": [\n        \"5dda747d-7fdd-4694-85ff-ce4f893ce51e\"\n    ]\n}\n```\n\nNote the `aud` claim: the server explicitly states the token's audience is Client A, yet returns the full metadata to Client B. Per RFC 7662 section 4 (\"The authorization server SHOULD also limit the information it discloses about each token to the resources that are authorized to receive it\") the introspection result must not be disclosed to clients other than the token's audience.\n\nFull reproduction script attached as `poc.sh`. Full session log attached as `live_run.log`.\n\n## Root cause\n\n`routers/web/auth/oauth2_provider.go:130-175` `IntrospectOAuth`:\n\n```go\nfunc IntrospectOAuth(ctx *context.Context) {\n    clientIDValid := false\n    authHeader := ctx.Req.Header.Get(\"Authorization\")\n    if parsed, ok := httpauth.ParseAuthorizationHeader(authHeader); ok \u0026\u0026 parsed.BasicAuth != nil {\n        clientID, clientSecret := parsed.BasicAuth.Username, parsed.BasicAuth.Password\n        app, err := auth.GetOAuth2ApplicationByClientID(ctx, clientID)\n        if err != nil \u0026\u0026 !auth.IsErrOauthClientIDInvalid(err) {\n            log.Error(\"Error retrieving client_id: %v\", err)\n            ctx.HTTPError(http.StatusInternalServerError)\n            return\n        }\n        clientIDValid = err == nil \u0026\u0026 app.ValidateClientSecret([]byte(clientSecret))\n    }\n    if !clientIDValid {\n        ctx.Resp.Header().Set(\"WWW-Authenticate\", `Basic realm=\"Gitea OAuth2\"`)\n        ctx.PlainText(http.StatusUnauthorized, \"no valid authorization\")\n        return\n    }\n\n    var response struct {\n        Active   bool   `json:\"active\"`\n        Scope    string `json:\"scope,omitempty\"`\n        Username string `json:\"username,omitempty\"`\n        jwt.RegisteredClaims\n    }\n\n    form := web.GetForm(ctx).(*forms.IntrospectTokenForm)\n    token, err := oauth2_provider.ParseToken(form.Token, oauth2_provider.DefaultSigningKey)\n    if err == nil {\n        grant, err := auth.GetOAuth2GrantByID(ctx, token.GrantID)\n        if err == nil \u0026\u0026 grant != nil {\n            app, err := auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)  // shadows the introspecting client's `app`\n            if err == nil \u0026\u0026 app != nil {\n                response.Active = true\n                response.Scope = grant.Scope\n                response.RegisteredClaims = oauth2_provider.NewJwtRegisteredClaimsFromUser(app.ClientID, grant.UserID, nil)\n            }\n            if user, err := user_model.GetUserByID(ctx, grant.UserID); err == nil {\n                response.Username = user.Name\n            }\n        }\n    }\n\n    ctx.JSON(http.StatusOK, response)\n}\n```\n\nThe handler:\n\n1. Authenticates the introspecting client via HTTP Basic (`app.ValidateClientSecret`). The local variable `app` at this point references the introspecting client.\n2. Loads the grant for `form.Token` via `auth.GetOAuth2GrantByID(ctx, token.GrantID)`.\n3. **Reassigns** `app` to `auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)` (line 162). After this point, `app` is the token's issuing client, not the introspecting client.\n4. Populates `response` from the reassigned `app` and the grant.\n\nThere is no comparison between the introspecting client's id and `grant.ApplicationID`. The endpoint will return metadata for any token whose JWT signature validates, regardless of which client is asking.\n\n## Patch parity with PR #37704\n\nThe same file contains two recently-hardened handlers in commit `7e54514316` (\"fix(oauth): bind token exchanges to the original client request\", PR #37704, 2026-05-15) that added exactly this missing check:\n\n`handleRefreshToken` (routers/web/auth/oauth2_provider.go:561-568):\n\n```go\nif grant.ApplicationID != app.ID {\n    handleAccessTokenError(ctx, oauth2_provider.AccessTokenError{\n        ErrorCode:        oauth2_provider.AccessTokenErrorCodeInvalidGrant,\n        ErrorDescription: \"refresh token belongs to a different client\",\n    })\n    return\n}\n```\n\n`handleAuthorizationCode` (routers/web/auth/oauth2_provider.go:640-647):\n\n```go\nif authorizationCode.RedirectURI != \"\" \u0026\u0026 form.RedirectURI != authorizationCode.RedirectURI {\n    handleAccessTokenError(ctx, oauth2_provider.AccessTokenError{ ... })\n    return\n}\n// later in the same function:\nif authorizationCode.Grant.ApplicationID != app.ID {\n    handleAccessTokenError(ctx, ...)\n    return\n}\n```\n\n`IntrospectOAuth` shares the same problem space (it consumes a token bound to a grant whose application may differ from the requesting client) but did not receive the parallel patch.\n\n## Impact\n\nAny authenticated OAuth client can call `/login/oauth/introspect` with another client's access or refresh token in the body and learn:\n\n* `active` (true or false). A token-validity oracle that survives across application boundaries without consuming or \"using\" the token.\n* `scope`. The scope of the token.\n* `username`. The user the token belongs to.\n* `iss`, `sub`, `aud`. Standard JWT registered claims. `aud` reveals the issuing client_id, making it obvious to the introspecting client that the token does not belong to them. The server returns the data anyway.\n\nPractical scenarios:\n\n1. **Stolen-token validation oracle.** An attacker who exfiltrates an access token from logs, traffic capture, browser memory, or a leaked dump can verify the token is still active before using it for higher-noise actions like API calls. The probe does not consume the grant counter, so it does not appear in audit trails of \"actual token use\".\n2. **Cross-tenant metadata enumeration.** Any user can register their own OAuth application on a Gitea instance (web UI: /user/settings/applications). The attacker uses their own valid credentials to introspect tokens belonging to other tenants' clients. They learn which user/scope each token corresponds to without ever using it.\n3. **Token-confusion reconnaissance.** Before chaining a separate vulnerability (e.g., a future token-replay or session-fixation bug), the attacker can use introspection to map the token universe.\n\n## Suggested remediation\n\nA one-line fix matching the PR #37704 pattern:\n\n```diff\n grant, err := auth.GetOAuth2GrantByID(ctx, token.GrantID)\n if err == nil \u0026\u0026 grant != nil {\n+    if grant.ApplicationID != app.ID {\n+        // do not reveal token metadata for tokens not issued to this client\n+        ctx.JSON(http.StatusOK, response)  // response is zero-valued, active=false\n+        return\n+    }\n     app, err := auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)\n```\n\nOr, equivalently, replace the inner `app` reassignment with a check that uses the introspecting client's `app.ClientID` directly for the response claims.\n\n## Affected versions\n\nConfirmed at Gitea v1.26.1 (latest release, 2026-04-24, docker image `gitea/gitea:1.26.1`). The vulnerable code path has been in place since the introspection endpoint was introduced; the recent PR #37704 / #37706 OAuth hardening landed in master May 15-16 2026 but did not touch this endpoint.\n\n## Attachments\n-  [poc.sh](https://github.com/user-attachments/files/28182098/poc.sh): Full reproduction script.\n-  [live_run.log](https://github.com/user-attachments/files/28182115/live_run.log): Full session log.","status":"published","published":"2026-07-21T20:21:33Z","modified":"2026-07-27T17:11:15.802189043Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-863"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"GO-2026-6079","title":"Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) in gitea.dev","description":"Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) in gitea.dev","status":"published","published":"2026-07-27T15:32:45Z","modified":"2026-07-27T17:00:25.905127744Z","updated_at":"2026-11-02T15:47:02.838915Z"},{"id":"openSUSE-SU-2026:21551-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:38:07Z","modified":"2026-08-12T18:23:41.809969353Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23216-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:34:15Z","modified":"2026-08-27T18:23:09.233788558Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23227-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:34:15Z","modified":"2026-08-27T18:23:10.174179412Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}