Skip to content
OpenAdvisories

Vendor

node-oauth

1 known vulnerabilities.

Products

node-oauth2-server 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.9
    CVE-2026-41213

    @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

    @node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and faile…

    node-oauth node-oauth2-server @node-oauth/oauth2-server npm