CVE-2026-101271 — OAuth credentials not disabled when application is disabled
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
Published: 2026-09-29 · CVSS: 2.1 · CVSS 4.0
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7