CVE-2026-101271

OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.

Score

CVSS 4.0 2.1 Low

Status

Deferred - 655498c3-6ec5-4f0b-aea6-853b334d05a6

Published

2026-09-29

Last modified

2026-09-29

Weaknesses

CWE-613

Affected products

• Pretix (Pretix)

References

• https://pretix.eu/about/en/blog/20260929-release-2026-7-1/