Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant…

Gitea's OAuth2 token endpoint fails to verify that a token submitted under the refresh_token grant type is actually a refresh token, accepting any valid signed token from the same OAuth2 application and grant. An attacker holding an unexpired access token for that application and grant, reachable over the network without authentication or user interaction, can exchange it for a new access token and refresh token, extending their access beyond the original token's lifetime.