Technical impact
The vulnerability allows OAuth access tokens to remain valid for their full lifetime even after the OAuth client application they belong to is manually disabled. This means that any party possessing a valid token can continue to authorize requests against the Pretix service until the token naturally expires. The weakness aligns with CWE‑613, reflecting inadequately handled token revocation.
Affected Systems
Affected systems are installations of Pretix, the open‑source event ticketing platform. The vulnerability has been identified for the pretix:pretix product; no specific version ranges are listed in the CNA data, so all released versions before the latest patch may be susceptible. Administrators should review their Pretix instance for any disabled applications that still possess active tokens.
Risk and Exploitability
The CVSS score of 2.1 indicates a low severity impact. EPSS is not available, and the vulnerability is not catalogued in CISA KEV. Exploitation requires an attacker to already have a valid OAuth token; the attack vector is minimal because the vulnerability concerns token validity rather than remote code execution. Nevertheless, the persistence of an otherwise disabled application can enable continued unauthorized access, so administrators should mitigate immediately.
