CVE-2026-40205: Medium severity vulnerability
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly requires all of them. The configured authorization policy is not enforced, so a token that was granted only part of the required permissions is accepted where it should have been rejected. Use local token validation where tokens can be validated locally. Update to non-vulnerable version. No publicly available exploits are known.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the configured authorization policy is enforced during token validation so that tokens granted only a partial set of required scopes are rejected.
OAuth2 token validation authorization policy enforcement / remote token validation behavior = enforce configured authorization policy - Configuration
Use local token validation where tokens can be validated locally to ensure all required scopes are checked (since the local validation path correctly requires all of them).
OAuth2 token validation token validation mode = local token validation - Compensating control
Restrict token validation to local validation paths when possible, avoiding remote token validation behavior that may accept tokens with only one of multiple required scopes.
Event History
Frequently Asked Questions
Which configurations are affected?
Affected deployments use remote OAuth2 token validation and configure an authorization policy requiring more than one scope. Local token validation correctly requires all configured scopes.
What does an attacker need to exploit this?
The attacker needs an OAuth2 token that includes only part of the scopes required by the configured policy. The vulnerable remote validation path may accept that token even though it lacks the full required scope set.
What can be done before an update is available or applied?
Use local token validation where tokens can be validated locally. This path correctly enforces all required scopes.
Are public exploits known?
No publicly available exploits are known.