GHSA-vxv2-8j6r-pcpg: Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Live reproduction against Gitea 1.26.1 Setup: Gitea 1.26.1 docker stack with two users (admin and victim) and two OAuth applications owned by different users: Client A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e owner=admin Client B: id=588f778f-4a41-4914-ae01-85d776c369db owner=victim admin runs an OAuth flow against Client A and obtains an access token. victim (acting through Client B's credentials) calls the introspection endpoint with Client A's access token in the body: $ curl -s -u "$B_ID:$B_SEC" -X POST http://localhost:3001/login/oauth/introspect \ --data-urlencode "token=$CLIENT_A_ACCESS_TOKEN" { "active": true, "username": "admin", "iss": "http://localhost:3001", "sub": "1", "aud": [ "5dda747d-7fdd-4694-85ff-ce4f893ce51e" ] } Note the aud claim: the server explicitly states the token's audience is Client A, yet returns the full metadata to Client B. Per RFC 7662 section 4 ("The authorization server SHOULD also limit the information it discloses about each token to the resources that are authorized to receive it") the introspection result must not be disclosed to clients other than the token's audience. Full reproduction script attached as poc.sh. Full session log attached as live_run.log. Root cause routers/web/auth/oauth2_provider.go:130-175 IntrospectOAuth: func IntrospectOAuth(ctx *context.Context) { clientIDValid := false authHeader := ctx.Req.Header.Get("Authorization") if parsed, ok := httpauth.ParseAuthorizationHeader(authHeader); ok && parsed.BasicAuth != nil { clientID, clientSecret := parsed.BasicAuth.Username, parsed.BasicAuth.Password app, err := auth.GetOAuth2ApplicationByClientID(ctx, clientID) if err != nil && !auth.IsErrOauthClientIDInvalid(err) { log.Error("Error retrieving client_id: %v", err) ctx.HTTPError(http.StatusInternalServerError) return } clientIDValid = err == nil && app.ValidateClientSecret([]byte(clientSecret)) } if !clientIDValid { ctx.Resp.Header().Set("WWW-Authenticate", Basic realm="Gitea OAuth2") ctx.PlainText(http.