Read the docs
TI-2021-10150 Aliases CVE-2021-29437

Account compromise by man-in-the-middle attack

Priority LOW 37CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a third party. 1. Scratch user visits 3rd party site. 2. 3rd party site asks user for Scratch username. 3. 3rd party site pretends to be user and gets login code from ScratchOAuth2. 4. 3rd party site gives code to user and instructs them to post it on their profile. 5. User posts code on their profile, not knowing it is a ScratchOAuth2 login code. 6. 3rd party site completes login with ScratchOAuth2. 7. 3rd party site has full access to anything the user could do if they directly logged in. See referenced GitHub security advisory for patch notes and workarounds.

Why it matters now

EPSS 0.00894 59th percentileScored 2026-11-07
Fix Fixed ScratchOAuth2 (ScratchVerifier): 9220c2a

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ScratchVerifierScratchOAuth2before 9220c2a9220c2aPatch availableCNA
  • ScratchOAuth2 VendorScratchVerifier Affected before 9220c2a Fixed in 9220c2a Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:scratchoauth2_project:scratchoauth2:*:*:*:*:*:scratch:*:*before 2021-04-13VulnerableScratchoauth2 Project
  • cpe:2.3:a:scratchoauth2_project:scratchoauth2:*:*:*:*:*:scratch:*:* Versions before 2021-04-13 Vulnerable ·Scratchoauth2 Project

Remediation

  • Fix · CNA ScratchOAuth2 (ScratchVerifier) Fixed in 9220c2a

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29437

References

Patch 2

  • TI-2020-16057 Verification Code Hijacking in ScratchVerifier CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences