Threats tagged 'ghsa-r767-66jg-55q2'

A vulnerability exists in the OAuth2 token introspection mechanism when the allowed_scopes configuration is enabled. The mechanism does not immediately invalidate a token in the cache after a revocation request, causing a revoked access token to potentially be re-issued to the client until the cache entry is cleared. Although the re-issued token is not valid for API authorization, affected users may experience disruptions in obtaining new valid access tokens during this period.