CVE-2026-101271CWE-613

CVE-2026-101271

published September 29, 2026

CVSS
2.1
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.

The record
Technical detail
CVSS
2.1 · NONE
CVSS v4.0
2.1 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00170 · 6.0th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-09-29T17:17Z
References (1)
https://pretix.eu/about/en/blog/20260929-release-2026-7-1/ · 655498c3-6ec5-4f0b-aea6-853b334d05a6
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 12:03Z
    OAuth credentials not disabled when application is disabled
    cvelistv5