Vulnerability Description
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
CVSS Score
LOW
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-3583?
CVE-2026-3583 is a vulnerability with a CVSS score of 3.1 (LOW). When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario...
How severe is CVE-2026-3583?
CVE-2026-3583 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-3583?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.