TI-2017-14072 CVE-2017-18924 · GHSA-2fw4-mgq9-39cx
oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE.
Priority LOW 37
oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE.
Oauth2-server Project
Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Oauth2-server Project records in CISA KEVNo Oauth2-server Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
2 records
TI-2020-16364 CVE-2020-26938 · GHSA-4rg6-fm25-gc34
In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri…
Priority LOW 34
In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked against an incorrect URI pattern ("[a-zA-Z][a-zA-Z0-9+.-]+:"…