Live › vulnerability › CVE-2026-118394
The OAuth2 userinfo endpoint ignored the scope of the token that authenticated the request when deciding whether to limit the groups claim to public organizations. A public-only token sent as a query parameter or form field, or a public-only personal access token, let the claim list the owner's private organizations, teams and concealed memberships.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 10:49 UTC. All times on this page are UTC.
Systems that expose the OAuth2 userinfo endpoint (/login/oauth/userinfo) and issue OAuth2 or personal access tokens with limited public scope. Exposure is limited to organization and team names and memberships; repository content is not exposed. The sources do not say which product or versions are affected.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The OAuth2 userinfo endpoint (/login/oauth/userinfo) decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token.
This page as .md · .json · in your agent: get_signal("CVE-2026-118394")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.