In Gitea versions before 1.27.0, the OAuth token introspection endpoint improperly returns metadata for tokens issued to other OAuth clients. The endpoint authenticates the introspecting client but then overwrites the client context with the token's issuing client without verifying that these clients match. Consequently, any authenticated OAuth client can introspect tokens issued to other clients and receive token metadata, violating the OAuth 2.0 Token Introspection specification (RFC 7662 section 4). This is due to missing authorization checks in the introspection handler function. Related handlers have been recently patched to enforce client binding, but the introspection endpoint remains vulnerable in these versions.

An authenticated OAuth client can retrieve metadata about access tokens issued to other clients, potentially exposing sensitive information such as usernames and token scopes. This information disclosure violates OAuth 2.0 best practices and may aid attackers in reconnaissance or further attacks. The vulnerability does not allow token misuse or token forgery but leaks token metadata across client boundaries.

A fix is available in Gitea versions 1.27.0 and later that enforces client binding checks in the OAuth token introspection endpoint. Users should upgrade to version 1.27.0 or later to remediate this issue. Until upgraded, restrict access to the introspection endpoint to trusted clients only. Patch status is confirmed by the absence of the vulnerability in versions >=1.27.0.