Short description of the vulnerability: 

When a user signs in through the generic OAuth, Google, or GitLab single sign-on connectors, Grafana wrote the user's OAuth or OIDC tokens to its server log in plaintext if the identity provider returned a non-JWT (opaque) token or if token parsing failed. With the generic OAuth connector this happened at the default log level, and some of those log lines also contained the refresh token and the ID token. Anyone able to read the Grafana server logs, or the log pipeline they are shipped to, could recover live credentials scoped to the Grafana OAuth client. This is not remotely exploitable and does not by itself allow account takeover; the impact is bounded by the scopes granted to that OAuth client. The azuread, github, okta, and grafana.com connectors are not affected. 

Known mitigations: 

Update to one of the private builds listed above. Until you have updated, reduce exposure by restricting read access to Grafana server logs and any downstream log pipeline, shortening log retention, and minimising the scopes granted to the Grafana OAuth client. If your identity provider issues long-lived or non-expiring tokens, rotate the Grafana OAuth client secret and revoke issued tokens at the provider. 

Affected products and versions: 

Grafana OSS and Grafana Enterprise: 12.2.0 to 12.2.11, 12.3.0 to 12.3.11, 12.4.0 to 12.4.9, 13.0.0 to 13.0.7, 13.1.0 to 13.1.4, and 13.2.0.