GHSA-jhm7-29pj-4xvf
Medium · 5.9CVSS
5.9
EPSS
—
Published
Apr 16, 2026
CISA due date
—
The record
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @node-oauth/oauth2-server | 0 | 5.3.0 |
Related vulnerabilities
- CVE-2026-41213 @node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. Same vulnerability
- CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. CWE-1289
- CVE-2026-89049 A server-side request forgery issue due to improper validation of equivalent address… CWE-1289
- CVE-2026-76977 SAP UI5 does not sufficiently validate the parent frame's origin against the configured… CWE-1289
- CVE-2026-74994 The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia… CWE-1289
- CVE-2026-19953 URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode… CWE-1289
- CVE-2026-60074 Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal… CWE-1289
- CVE-2026-42462 Fedify is a TypeScript library for building federated server apps powered by ActivityPub. CWE-1289