Access Restriction Bypass Affecting oauth2-server package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-OAUTH2SERVER-1255585
- published 26 Apr 2021
- disclosed 22 Apr 2021
- credit Unknown
Introduced: 22 Apr 2021
CVE-2017-18924 Open this link in a new tabHow to fix?
There is no fixed version for oauth2-server.
Overview
oauth2-server is a Complete, framework-agnostic, compliant and well tested module for implementing an OAuth2 Server in node.js
Affected versions of this package are vulnerable to Access Restriction Bypass via implementation of OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692.
NOTE: this vulnerability is disputed by the vendor, who states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.'