Homepage

@feathersjs/authentication-oauth@5.0.39 vulnerabilities

oAuth 1 and 2 authentication for Feathers. Powered by Grant.

  • latest version

    5.0.41

  • latest non vulnerable version

    6.0.0-pre.0

  • first published

    6 years ago

  • latest version published

    9 days ago

  • licenses detected

  • View authentication-oauth package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @feathersjs/authentication-oauth package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Open Redirect

    @feathersjs/authentication-oauth is an oAuth 1 and 2 authentication for Feathers. Powered by Grant.

    Affected versions of this package are vulnerable to Open Redirect due to the improper validation of redirect query parameter. An attacker can obtain a victim's access token and impersonate them by injecting a crafted URL that causes the browser to redirect to an attacker-controlled domain.

    How to fix Open Redirect?

    Upgrade @feathersjs/authentication-oauth to version 5.0.40 or higher.

    <5.0.40
    • H
    Origin Validation Error

    @feathersjs/authentication-oauth is an oAuth 1 and 2 authentication for Feathers. Powered by Grant.

    Affected versions of this package are vulnerable to Origin Validation Error in the getAllowedOrigin() function. An attacker can gain unauthorized access to sensitive information and potentially take over user accounts by initiating the OAuth flow from a malicious domain that shares a prefix with an allowed origin, thereby bypassing origin validation.

    How to fix Origin Validation Error?

    Upgrade @feathersjs/authentication-oauth to version 5.0.40 or higher.

    <5.0.40
    • H
    Exposure of Sensitive System Information to an Unauthorized Control Sphere

    @feathersjs/authentication-oauth is an oAuth 1 and 2 authentication for Feathers. Powered by Grant.

    Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere in the session cookies. An attacker can access sensitive internal infrastructure details, such as API keys, service tokens, and internal IP addresses, by decoding the HTTP request headers.

    How to fix Exposure of Sensitive System Information to an Unauthorized Control Sphere?

    Upgrade @feathersjs/authentication-oauth to version 5.0.40 or higher.

    <5.0.40
    Go back to all versions of this package