CVE-2017-18924

oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE

published October 4, 2020

CVSS
—
EPSS
2%
Percentile
82.2
In the wild
Unconfirmed
What it is

oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02190 · 82.2th percentile
Published
2020-10-04T04:38Z
EPSS history
Timeline
  • 04 OCT 04:38Z
    oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE
    cvelistv5