Low severity · published Sep 29, 2026
CVE-2026-101271
OAuth credentials not disabled when application is disabled
2.1
CVSS
0.2%
EPSS
No
On KEV
Description
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
pretix · pretix
0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101271
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101271
vendor-advisory
https://pretix.eu/about/en/blog/20260929-release-2026-7-1/
More from pretix
9.8
CVE-2024-27447
pretix before 2024.1.1 mishandles file validation
8.8
CVE-2026-57532
Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser
7.7
CVE-2026-13602
Session takeover vulnerability
6.5
CVE-2026-2452
Unsafe variable evaluation in email templates
6.5
CVE-2026-2451
Unsafe variable evaluation in email templates