CVE-2026-101271
LowCVSS 2.1Summary
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
Risk Assessment
Disabling an OAuth application does not invalidate tokens, which may allow unauthorized access to resources even after deactivation, increasing the risk of security breaches.
Recommendation
It is recommended to implement a token revocation mechanism when disabling OAuth applications and to regularly audit token validity.
Other vulnerabilities in OAuth
See all- CVE-2026-58422Critical
A vulnerability in the OAuth sign-in callback mechanism silently re-enables accounts that were disabled by an administrator. Improper authorization allows bypassing administrative account lockout decisions.
- CVE-2026-54605High
A vulnerability in the OAuth Ruby library allows an attacker to capture the Authorization header during a redirect. The OAuth::Consumer client follows a 3xx redirect, which can mutate the configuration and expose sensitive data.
- CVE-2026-13707High
Session fixation vulnerability in the Wikimedia Foundation OAuth extension. An attacker can force a victim to use a known session identifier, potentially leading to session hijacking.
Original NVD description (English source)
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS