Homepage
About Snyk

Access Restriction Bypass Affecting oauth2-server package, versions *

0.0
high

Snyk CVSS

    Attack Complexity Low
    Confidentiality High

    Threat Intelligence

    EPSS 0.78% (82nd percentile)
Expand this section
NVD
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-OAUTH2SERVER-1255585
  • published 26 Apr 2021
  • disclosed 22 Apr 2021
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 22 Apr 2021

CVE-2017-18924 Open this link in a new tab
CWE-94 Open this link in a new tab

How to fix?

There is no fixed version for oauth2-server.

Overview

oauth2-server is a Complete, framework-agnostic, compliant and well tested module for implementing an OAuth2 Server in node.js

Affected versions of this package are vulnerable to Access Restriction Bypass via implementation of OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692.

NOTE: this vulnerability is disputed by the vendor, who states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.'

References