[Security] OAuth token from lower environment works in higher environments

HighPublished Aug 25, 2026

### Summary OAuth tokens generated in lower environments (DEV) are valid in higher environments (UAT/PROD). This breaks environment isolation and poses a critical security risk. ### Details - A token generated from `xx.xxx.xx.xxx:4444` is **not working** in `xxxxxxxxxxxx.dev.xxxxxxxdev.com`. - A token generated from `xxxxxxxxxxxx.dev.xxxxxxxdev.com` is **working** in: - `xxxxxxxxxxxx.uat.xxxxxxxdev.com` - `xxx-xxxxxxxxx.dev.xxxxxxxdev.com` Tokens should be scoped per environment, but Context Forge Gateway accepts them across environments. ### PoC 1. Generate an OAuth token from `xxxxxxxxxxxx.dev.xxxxxxxdev.com`. 2. Use the token to call APIs in `xxxxxxxxxxxx.uat.xxxxxxxdev.com`. 3. Observe that the token is accepted and grants access. ### Impact - Cross‑environment access without proper authorization. - Potential exposure of sensitive data in higher environments. - Breaks isolation between DEV, UAT, and PROD. - Severity: **High / Critical** ### Version 0.9.0