Node Oauth2 Server
Approved changes feed: RSS · Atom
cpe:2.3:a:node-oauth:node-oauth2-server:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Node Oauth (26fc9889-7225-54d2-a233-383e21cf37bd) |
|---|---|
| Product | Node Oauth2 Server (5d974fd4-1798-571c-a940-47a31871c6d0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41213 |
vulnerable | 2026-06-08 08:03:15.071756 |
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
MEDIUM (5.9)
@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.
Published: 2026-04-23T18:33:42.365Z
Updated: 2026-04-25T01:23:58.715Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.