CVE-2026-70482

Summary

The vulnerability allows an attacker to exchange an OAuth access token for a session token, potentially gaining unauthorized access to the platform.

Exploitability

Exploitation requires access to a valid OAuth access token from a registered client, making it moderately difficult. Precondition is that the OAuth token exchange feature is enabled.

Blast radius

If exploited, the attacker could gain full access to the platform as the token user, leading to potential data breaches or unauthorized actions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the OAuth token exchange feature or upgrade to version 0.11.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.