Description

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-13T17:17:26.627Z",
  "pubdate": "2026-08-13T17:17:26.627Z",
  "executiveSummary": "An OAuth token introspection vulnerability exists where the token introspection endpoint violates RFC 7662 Section 4 by returning metadata for tokens issued to other clients. This security flaw allows unauthorized clients or users to query and retrieve sensitive metadata regarding tokens that do not belong to them. The impact includes severe information disclosure, privacy violations, and potential reconnaissance opportunities for malicious actors targeting federated identity systems and API ecosystems. The affected systems are authorization servers implementing OAuth 2.0 token introspection without proper access controls and scope validation per RFC 7662. Risk implications involve unauthorized access to sensitive token attributes, session tracking, and potential privilege escalation vectors depending on the disclosed metadata contents. Attacker capabilities include sending crafted introspection requests to harvest operational metadata of foreign tokens. Exploitation requirements typically involve valid authentication credentials to the introspection endpoint and the ability to capture or guess opaque or JWT-based token identifiers issued to distinct clients.",
  "technicalDetails": "The vulnerability stems from an improper implementation of the OAuth 2.0 Token Introspection specification, specifically failing to adhere to RFC 7662 Section 4. The root cause is the lack of strict tenant, client, or audience isolation within the introspection handler logic of the authorization server. When a client presents a token identifier to the introspection endpoint, the vulnerable component processes the query and returns the complete active state and associated metadata without validating whether the querying client is the intended recipient, resource server, or issuer authorized to view the token details.\nThe attack flow begins when an authenticated attacker obtains a token identifier—either through leakage, interception, or enumeration—that was originally issued to a different client application. The attacker then submits this token identifier to the target authorization server's introspection endpoint. Due to the absence of access control checks, the server evaluates the token and returns a JSON payload containing sensitive metadata such as client identifiers, user identifiers, scopes, expiration times, and custom claims associated with the foreign token. Network exposure is typically external via HTTPS, accessible to any registered client or authenticated entity permitted to query the introspection interface.\nPost-exploitation impact includes the harvesting of operational intelligence regarding other applications within the same ecosystem. An attacker can map out active user sessions, identify internal client identifiers, determine privilege levels across different applications, and potentially correlate user activity across disparate services. No specific function names or affected software versions are provided, but the vulnerability remains inherent to non-compliant OAuth 2.0 authorization server implementations that trust introspection requests blindly based solely on caller authentication rather than authorization to inspect the specific token."
}