CVE Catalog
CVE-2026-55982
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk0.17%
7th percentile - higher than 7% of all known CVEs
Summary
The OIDC userinfo endpoint returns identity claims without enforcing API token scopes.
Risk Assessment
An attacker with a limited-scope token can obtain full identity claims, violating privacy.
Recommendation
Apply the patch and configure the userinfo endpoint to enforce required scopes.
Original NVD description (English source)
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes