Skip to content

Add advisory for auth-framework: OAuth client tokens accepted as user sessions #3476

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ciresnave-bot wants to merge 1 commit into from
Closed

Add advisory for auth-framework: OAuth client tokens accepted as user sessions #3476

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions crates/auth-framework/RUSTSEC-0000-0000.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "auth-framework"
date = "2026-10-31"
url = "https://github.com/ciresnave/auth-framework/security/advisories/GHSA-jghc-wgvq-4r28"
categories = ["privilege-escalation"]
keywords = ["oauth2", "authorization", "access-token"]
aliases = ["GHSA-jghc-wgvq-4r28"]
cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
cwe = ["CWE-863"]

[versions]
patched = [">=0.4.46, <0.5.0-rc1",">=0.5.0-rc82, <0.6.0-0","=0.6.0-rc46","=0.6.0-rc47","=0.6.0-rc48","=0.6.0-rc50","=0.6.0-rc51","=0.6.0-rc52","=0.6.0-rc53","=0.6.0-rc54","=0.6.0-rc55","=0.6.0-rc69","=0.6.0-rc73","=0.6.0-rc85","=0.6.0-rc92","=0.6.0-rc97","=0.6.0-rc98","=0.6.0-rc101","=0.6.0-rc104","=0.6.0-rc106","=0.6.0-rc107","=0.6.0-rc109","=0.6.0-rc112","=0.6.0-rc114","=0.6.0-rc121","=0.6.0-rc126","=0.6.0-rc127","=0.6.0-rc128","=0.6.0-rc129","=0.6.0-rc131","=0.6.0-rc138","=0.6.0-rc150","=0.6.0-rc159","=0.6.0-rc166","=0.6.0-rc167","=0.6.0-rc173",">=0.6.0"]
unaffected = ["<0.4.0"]
```

# OAuth client access tokens accepted as user sessions; client scope not enforced

Access tokens issued to an OAuth client were indistinguishable from user session tokens. Endpoints that require a signed-in user accepted them, and a client's registered scope constrained only the token's scope string. A registered client could therefore act with user-session authority.

Affected: 0.4.0 to 0.4.45, 0.5.0-rc1 to 0.5.0-rc79, and 0.6.0-rc41, rc42 and rc45. All affected versions are already yanked. Versions before 0.4.0 were not examined.

## Patched
0.4.46, 0.5.0-rc82 and 0.6.0-rc46 (and later 0.6.0 releases). Tokens issued to a client are now bound to the client and refused by session endpoints, and a client is granted only its registered scopes. Session endpoints now refuse client-issued tokens and `/oauth/authorize` refuses unregistered scopes (`invalid_scope`). Tokens issued before the upgrade carry no client binding and remain accepted until they expire.

Integrators with routes meant for delegated access should use the delegated-token validation added in the fixed releases.
Loading