In RFC7009 - section 2.1, it is stated that:
The authorization server first validates the client credentials (in case of a confidential client) and then verifies whether the token was issued to the client making the revocation request. If this validation fails, the request is refused and the client is informed of the error by the authorization server as described below.
And then in section 2.2
The authorization server responds with HTTP status code 200 if the token has been revoked successfully or if the client submitted an invalid token.
Returning an error in this case (and not the standard 200 HTTP status) would leak to another client that the token exists and is actually valid, which seems to me a security flaw, even though scanning for tokens is hard (but not impossible) if tokens are generated with enough entropy.
What do you think?