Severity: CRITICAL
Surfaced by the 2026-05-24 coverage-scan retrofit (reverse-spec of auth-system, PR #1785). Captured in spec as REQ-AUTH-101 (observed behavior).
The bug
lib/Service/AuthorizationService::authorizeOAuth($header) never parses the bearer token. It only checks:
str_starts_with($header, 'Bearer') — header starts with the literal wordIUserSession::isLoggedIn() — already-authenticated session cookie present
On any request with an active session cookie, any value of Authorization: Bearer literally-anything passes the OAuth check. The 'token' is never validated, decoded, or even read.
The existing auth-system spec's section "OAuth2 token scopes MUST translate to RBAC verdicts" (lines 462–488 of openspec/specs/auth-system/spec.md) describes the intended behavior but is not implemented. The spec is aspirational, not descriptive.
Impact
If any consumer trusts the OAuth path for stricter access (e.g. scoped read-only tokens distinct from session-level write access), the trust is misplaced. The endpoint accepts the Bearer header but provides no actual OAuth enforcement — sessions get the same access as if no Bearer auth were configured.
Fix options
Option A (recommended): Implement real OAuth token parsing + validation. Decode the JWT/opaque token, look up scopes, return distinct verdicts from session-level auth. Substantial work.
Option B: Remove the OAuth path entirely. Document that only NC session auth + Basic Auth are supported. Update the spec to match.
Option C: Restrict the OAuth code path so it ONLY succeeds with a fully-validated token, NEVER on session-cookie alone. Behavior change for any consumer relying on the current (broken) fallback.
Related
Severity: CRITICAL
Surfaced by the 2026-05-24 coverage-scan retrofit (reverse-spec of
auth-system, PR #1785). Captured in spec as REQ-AUTH-101 (observed behavior).The bug
lib/Service/AuthorizationService::authorizeOAuth($header)never parses the bearer token. It only checks:str_starts_with($header, 'Bearer')— header starts with the literal wordIUserSession::isLoggedIn()— already-authenticated session cookie presentOn any request with an active session cookie, any value of
Authorization: Bearer literally-anythingpasses the OAuth check. The 'token' is never validated, decoded, or even read.The existing
auth-systemspec's section "OAuth2 token scopes MUST translate to RBAC verdicts" (lines 462–488 ofopenspec/specs/auth-system/spec.md) describes the intended behavior but is not implemented. The spec is aspirational, not descriptive.Impact
If any consumer trusts the OAuth path for stricter access (e.g. scoped read-only tokens distinct from session-level write access), the trust is misplaced. The endpoint accepts the Bearer header but provides no actual OAuth enforcement — sessions get the same access as if no Bearer auth were configured.
Fix options
Option A (recommended): Implement real OAuth token parsing + validation. Decode the JWT/opaque token, look up scopes, return distinct verdicts from session-level auth. Substantial work.
Option B: Remove the OAuth path entirely. Document that only NC session auth + Basic Auth are supported. Update the spec to match.
Option C: Restrict the OAuth code path so it ONLY succeeds with a fully-validated token, NEVER on session-cookie alone. Behavior change for any consumer relying on the current (broken) fallback.
Related
openspec/specs/auth-system/spec.mdlines 462-488lib/Service/AuthorizationService.php::authorizeOAuth