Oauth2 Server
Approved changes feed: RSS · Atom
cpe:2.3:a:oauth2-server_project:oauth2-server:*:*:*:*:*:node.js:*:*part: a version: * update: *
| Vendor | Oauth2 Server Project (889d9a0b-3ff4-5668-b07c-9e254e3db812) |
|---|---|
| Product | Oauth2 Server (ee41fda5-163a-5b56-b1e5-884b3292c39f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-26938 |
vulnerable | 2026-06-08 05:23:51.943490 |
Details available
In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked against an incorrect URI pattern ("[a-zA-Z][a-zA-Z0-9+.-]+:") before making a redirection. This allows a malicious client to pass an XSS payload through the redirect_uri parameter while making an authorization request. NOTE: this vulnerability is similar to CVE-2020-7741.
Published: 2022-08-29T20:51:04.000Z
Updated: 2024-08-04T16:03:23.138Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-18924 |
vulnerable | 2026-06-08 05:09:12.745146 |
Details available
oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.
Published: 2020-10-04T04:38:47.000Z
Updated: 2024-08-05T21:45:24.546Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.