UID2-7641: Remove support for V2 refresh tokens - #2718

Open

samin-ttd wants to merge 5 commits into

mainfrom

sra-UID2-7641-fix-refresh-padding-oracle-vulnerability

Commits on Sep 2, 2026

UID2-7641: Refresh returns 400 on error paths so attacker can't glean extra info
samin-ttd
committed
6e5241e
[CI Pipeline] Released Snapshot version: 5.70.281-alpha-332-SNAPSHOT [no-jira - reason: automated release]

github-actions[bot]
authored and
samin-ttd
committed
7cfb5b1
[CI Pipeline] Released Snapshot version: 5.70.282-alpha-333-SNAPSHOT [no-jira - reason: automated release]
github-actions[bot]
authored
a87a432

Commits on Sep 3, 2026

UID2-7641: Removed support for V2 refresh tokens
samin-ttd
committed
2139aff
UID2-7641: Removed catch all in refreshIdentity
samin-ttd
committed
24c0c92