CVE-2026-101271 — OAuth credentials not disabled when application is disabled

CVE-2026-101271

OAuth credentials not disabled when application is disabled PUBLISHED

Description (CNA)

OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.

Affected (CNA)

Vendor / product	Versions
pretix / pretix	affected 0.0 before 2026.5.5; affected 2026.6.0 before 2026.6.2; affected 2026.7.0 before 2026.7.1

CWE

No CWE identifiers supplied.

References

https://pretix.eu/about/en/blog/20260929-release-2026-7-1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.