External risk intelligence

OIDC Userinfo Endpoint Mishandles Identity Claims Without Scope Enforcement

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-55982

This vulnerability affects an OIDC userinfo endpoint, which is a public-facing identity component by design. Such endpoints are intended to be network-accessible to facilitate authentication and authorization workflows, making them a common part of the internet-facing attack surface in web application deployments.

Information Disclosure

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the OpenID Connect (OIDC) userinfo endpoint, potentially exposing identity information. This issue allows for the retrieval of sensitive user claims without proper API token scope enforcement, which could impact systems relying on OIDC for authentication and authorization. The primary concern is to confirm if your environment is affected and to what extent.

Sensitive user data could be exposed.
Affects systems using OIDC for identity.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could potentially access sensitive identity information by sending a request to the OIDC userinfo endpoint. This occurs because the endpoint may not correctly check if the request is authorized by an API token with the necessary permissions, leading to unauthorized disclosure and modification of user data.

No authentication required to access.
Requests to userinfo endpoint trigger vulnerability.
Exposes and allows modification of identity data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to retrieve sensitive identity information, such as names, email addresses, and unique identifiers, from the OIDC userinfo endpoint. This exposure may occur when the OIDC endpoint is improperly configured and does not validate API token scopes before returning user identity claims.

Sensitive identity information could be exposed.
An unauthenticated attacker could exploit this.
Unauthorized access to user data may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in OIDC userinfo endpoints, allowing identity claims without proper API token scope enforcement, likely impacts application owners and platform teams responsible for identity and access management. The first step is to identify all instances of the affected technology, determine their exposure (especially if network-accessible), and confirm business criticality to prioritize remediation efforts.

Own: Application and Platform Owners.
Verify: Exposure and criticality of affected systems.
Action: Plan remediation and coordinate with vendors.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software component affected by CVE-2026-55982?

This CVE affects the OpenID Connect (OIDC) userinfo endpoint. This component is a standardized part of identity management systems, used by applications to retrieve profile information about a logged-in user after they have authenticated. Based on the Gitea ecosystem, this endpoint acts as a bridge, allowing client applications to securely request specific identity details to personalize the user experience or manage access rights.

What is the nature of the vulnerability in CVE-2026-55982?

This issue is categorized under CWE-200, which relates to the exposure of sensitive information. Specifically, the OIDC endpoint fails to verify if the provided API token has the correct permissions, or 'scopes,' before sharing user identity claims. Instead of limiting data access to what is authorized, the system behaves as if the request is valid regardless of the token's actual constraints, potentially revealing private account information.

How can an attacker trigger this vulnerability?

An attacker can trigger this by sending a direct request to the OIDC userinfo endpoint. Crucially, the vulnerability does not require the attacker to have a valid or scoped authentication token to succeed. Simply making a network-level request to the endpoint is sufficient to receive the unintended identity data. Legitimate requests that include proper scoping are also affected, as the system fails to apply those restrictions entirely.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates this is a high-priority concern because OIDC userinfo endpoints are typically designed to be public-facing to support standard authentication workflows. Since these endpoints are intended to be network-accessible for legitimate identity services, they inherently exist within the internet-facing attack surface, increasing the likelihood that they can be reached by unauthorized parties.

How should I begin responding to this CVE?

First, locate all systems in your environment that utilize OIDC for authentication and specifically verify if they use the affected userinfo endpoint. Assess which of these instances are accessible via the network, prioritizing those exposed to the internet. Once mapped, review your platform's configuration for identity management and coordinate with your vendor for guidance or updates to ensure proper scope enforcement is restored.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.