CVE-2026-88819

Description

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.

Affected Platforms

Weakness Type

CWE-290, CWE-345

References

• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/931