Description
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | com.google.oauth-client:google-oauth-client | unspecified – < 1.31.0 | 1.31.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | google-oauth-client-java | 1.28.0-2 | — |
| Debian 13 | google-oauth-client-java | 1.28.0-2 | — |
| Debian 12 | google-oauth-client-java | 1.28.0-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | google-oauth-client-java | No fix yet | — |
| Ubuntu 26.04 LTS | google-oauth-client-java | No fix yet | — |
| Ubuntu 25.10 | google-oauth-client-java | No fix yet | — |
| Ubuntu 24.04 LTS | google-oauth-client-java | No fix yet | — |
| Ubuntu 22.04 LTS | google-oauth-client-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins | 2.361.1.1675668150-1.el8 | RHSA-2023:0777 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.9.1675668922-1.el8 | RHSA-2023:0777, RHSA-2023:0560 |
| Red Hat Ocp Tools 4 | jenkins | 2.387.3.1684911776-3.el8 | RHSA-2024:0778, RHSA-2023:6172, RHSA-2023:3299 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.12.1698294000-1.el8 | RHSA-2024:0778, RHSA-2023:6172, RHSA-2023:3299 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.google.oauth-client:google-oauth-client | < 1.31.0 | 1.31.0 | GHSA-f263-c949-w85g |
Advisories 7
- RHSA-2023:6172 Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:0778 Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:3299 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0777 Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0560 Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2024-0088 IBM Maximo Asset Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 15, 2024
References
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEOAUTHCLIENT-575276
- https://github.com/googleapis/google-oauth-java-client/issues/469
- https://github.com/googleapis/google-oauth-java-client/commit/13433cd7dd06267fc261f0b1d4764f8e3432c824
- https://tools.ietf.org/html/rfc8252%23section-8.1
- https://tools.ietf.org/html/rfc7636%23section-1
- [druid-commits] 20200724 [GitHub] [druid] suneet-s opened a new pull request #10214: Suppress CVE-2020-7692 mailing-list
- [druid-commits] 20200727 [druid] branch master updated: Suppress CVE-2020-7692 (#10214) mailing-list