When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.
The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
before 3.1.0 status unknown; from 3.1.0 before 3.1.0.367; from 3.2.0 before 3.2.0.475; from 3.2.1 before 3.2.1.106; from 4.0.0 before 4.0.0.394; from 4.1.0 before 4.1.0.267; from 4.2.0 before 4.2.0.207; from 4.3.0 before 4.3.0.120; and 4 more ranges
before 5.10.0 status unknown; from 5.10.0 before 5.10.0.397; from 5.11.0 before 5.11.0.444; from 6.0.0 before 6.0.0.270; from 6.1.0 before 6.1.0.269; from 7.0.0 before 7.0.0.152; from 7.1.0 before 7.1.0.61; from 7.2.0 before 7.2.0.20; and 1 more ranges
from 6.4.2 before 6.4.2.178; from 6.4.111 before 6.4.111.174; from 6.4.176 before 6.4.176.38; from 6.4.180 before 6.4.180.25; from 6.8.0 before 6.8.0.59; from 6.9.6 before 6.9.6.36; from 6.11.21 before 6.11.21.118; from 6.13.16 before 6.13.16.32; and 9 more ranges
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
