[Security] OAuth token from lower environment works in higher environments

Summary

OAuth tokens generated in lower environments (DEV) are valid in higher environments (UAT/PROD).

This breaks environment isolation and poses a critical security risk.

Details

• A token generated from xx.xxx.xx.xxx:4444 is not working in xxxxxxxxxxxx.dev.xxxxxxxdev.com.
• A token generated from xxxxxxxxxxxx.dev.xxxxxxxdev.com is working in:
• xxxxxxxxxxxx.uat.xxxxxxxdev.com
• xxx-xxxxxxxxx.dev.xxxxxxxdev.com

Tokens should be scoped per environment, but Context Forge Gateway accepts them across environments.

PoC

1. Generate an OAuth token from xxxxxxxxxxxx.dev.xxxxxxxdev.com.

2. Use the token to call APIs in xxxxxxxxxxxx.uat.xxxxxxxdev.com.

3. Observe that the token is accepted and grants access.

Impact

• Cross‑environment access without proper authorization.
• Potential exposure of sensitive data in higher environments.
• Breaks isolation between DEV, UAT, and PROD.
• Severity: High / Critical

Version

0.9.0