@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.3%
exploitation probability
0.3%top 83% of all CVEs
observed exploitation
nono source reports it
In short
A Node.js OAuth2 server library fails to properly validate PKCE code_verifier values during token exchange, allowing attackers to brute-force intercepted authorization codes instead of rejecting invalid verifiers immediately.
Technical detail
The library accepts RFC7636-invalid code_verifier values (including single characters) in S256 PKCE flows without proper ABNF enforcement. An attacker who intercepts an authorization code can perform online brute-force attacks since failed verification attempts do not consume the code, enabling token issuance without the legitimate code_challenge.
Summary generated and translated by AI from the official description.
@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
node-oauth · node-oauth2-server