Filtered by vendor Oauth2-server Project Subscriptions
Filtered by product Oauth2-server Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-18924 1 Oauth2-server Project 1 Oauth2-server 2024-08-05 7.5 High
oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.
CVE-2020-26938 1 Oauth2-server Project 1 Oauth2-server 2024-08-04 7.2 High
In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked against an incorrect URI pattern ("[a-zA-Z][a-zA-Z0-9+.-]+:") before making a redirection. This allows a malicious client to pass an XSS payload through the redirect_uri parameter while making an authorization request. NOTE: this vulnerability is similar to CVE-2020-7741.