Gitea before version 1.27.0 contains a vulnerability in its OAuth token introspection endpoint where it fails to verify that the client requesting token introspection is the same as the token's original audience. This missing check allows an authenticated client to retrieve metadata about tokens issued to different clients, violating RFC 7662 section 4. Although related handlers have been patched to include this check, the introspection endpoint in affected versions lacks this fix. This vulnerability is identified as CVE-2026-58425 and is classified under CWE-200 (Information Exposure) and CWE-863 (Incorrect Authorization).

An authenticated client can obtain metadata about OAuth tokens issued to other clients, potentially exposing sensitive token information. The vulnerability does not allow token misuse or denial of service but leaks token metadata, which may aid in further reconnaissance or attacks.

A patch is available for this vulnerability and should be applied by upgrading Gitea to version 1.27.0 or later. Applying the official fix will ensure the introspection endpoint properly verifies the client identity against the token's original audience, preventing unauthorized metadata disclosure.