CVE-2026-41213
MEDIUM EPSS 17.2%
Published Apr 23, 20262mo ago · Modified Jun 17, 20262w ago
5.9 CVSS 3.1
Published Apr 23, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago
Description
@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
17.2% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 2
CWE-1289
CWE-307
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| node-oauth | node-oauth\/oauth2-server | * | <5.3.0 |
References 1
- github.com https://github.com/node-oauth/node-oauth2-server/security/advisories/GHSA-jhm7-29pj-4xvf
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.