Description
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eclipse Foundation | Eclipse Data Plane Core | 0.1.0 – ≤ 0.1.3 | — |
Medium · 6.3
CVE-2026-88819
EUVD-2026-77577GHSA-2f3m-r9cf-82r7
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.
Published Sep 14, 2026 · Updated Sep 14, 2026 · Assigned by eclipse