Skip to content
OpenAdvisories

Package · npm

oauth2-server

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.2
    CVE-2020-26938

    oauth2-server through 3.1.1 vulnerable to Open Redirect

    In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked against an incorrect URI pattern ("[a-zA-Z][a-zA-Z0-9+.-]+:") before making a redirection. This all…

    oauth2-server npm
  • High 7.5
    CVE-2017-18924

    Code Injection in oauth2-server

    oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of…

    oauth2-server npm