GHSA-2fw4-mgq9-39cxHighCVSS 7.5

Code Injection in oauth2-server

Published
April 22, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2017-18924 →

📋 Description

"oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.'"

🎯 Affected products1

  • npm/oauth2-server:<= 3.1.1

🔗 References (7)