OAuth credentials not disabled when application is disabled
Priority LOW 10CWE-613Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.
Summary
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0017 6th percentileScored 2026-11-07
Fix Fixed pretix (pretix): 2026.5.5, 2026.6.2, 2026.7.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pretix | pretix | 0.0 to before 2026.5.5; 2026.6.0 to before 2026.6.2; 2026.7.0 to before 2026.7.1 | 2026.5.5, 2026.6.2, 2026.7.1 | Patch available | CNA |
- pretix Vendorpretix Affected 0.0 to before 2026.5.5; 2026.6.0 to before 2026.6.2; 2026.7.0 to before 2026.7.1 Fixed in 2026.5.5, 2026.6.2, 2026.7.1 Patch available CNA
Remediation
- Fix · CNA pretix (pretix) Fixed in 2026.5.5, 2026.6.2, 2026.7.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
pretix — pretix.eu/about/en/blog/20260929-release-2026-7-1
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-65165 Revenue information leakPriority LOW 19
- TI-2026-65167 Incorrect session validation for API-uploaded filesPriority LOW 11
- TI-2026-65168 HTML injectionPriority LOW 10
Timeline
- 2026-10-02 Threatist record created from CVE-2026-101271
- 2026-10-03 Alias added: GHSA-5v69-4wqp-6f66
References
More pretix vulnerabilities
- TI-2024-18268 pretix before 2024.1.1 mishandles file validation. CVSS 3.1CRITICAL 9.8
- TI-2026-11524 SSRF with API key leak in pretix-oppwa CVSS 4.0CRITICAL 9.0
- TI-2026-41416 Cross-site scripting in pretix CVSS 4.0HIGH 8.8
- TI-2026-11523 Session takeover vulnerability CVSS 4.0HIGH 7.7
- TI-2026-02082 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
- TI-2026-02081 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
Sources
- CVE-2026-101271 · CVE Program
- CVE-2026-101271 · NVD
- FIRST EPSS
- GHSA-5v69-4wqp-6f66 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences