EUVD-2026-25272Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects mandatory prior auth-code interception; PR:N because the token endpoint is publicly accessible; C:H because success yields bearer tokens; I:N and A:N because no data is modified and no service is disrupted.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6Blast Radius
ecosystem impact- 23 npm packages depend on @node-oauth/oauth2-server (21 direct, 2 indirect)
Ecosystem-wide dependent count for version 5.3.0.
DescriptionGitHub Advisory
@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.
AnalysisAI
PKCE code_verifier validation in @node-oauth/oauth2-server (versions <= 5.2.1) does not enforce RFC 7636 ABNF requirements, accepting arbitrarily short values including single-character strings for S256 flows. An attacker who intercepts an authorization code can brute-force the code_verifier online because failed attempts do not consume the code, allowing repeated guesses until token issuance succeeds. A working proof-of-concept is publicly documented in the GitHub security advisory; no active exploitation confirmed in CISA KEV.
Technical ContextAI
The affected library (cpe:2.3:a:node-oauth:node-oauth2-server:*:*:*:*:*:*:*:*) implements OAuth2 authorization flows in Node.js, including PKCE (RFC 7636), which protects authorization code grants against interception attacks. RFC 7636 mandates that code_verifier be a high-entropy string of 43-128 unreserved characters. The root cause (CWE-307: Improper Restriction of Excessive Authentication Attempts) manifests in two distinct defects: first, lib/pkce/pkce.js only checks that the verifier is a non-empty string before hashing for S256, never enforcing the 43-character minimum or charset; second, AuthorizationCodeGrantType.handle revokes the authorization code only after verifier comparison succeeds, meaning invalid guesses fail before revocation and the same code remains valid for unlimited subsequent attempts. The combination of weak server-side format enforcement and non-consuming failed attempts eliminates the entropy guarantee PKCE is designed to provide.
RemediationAI
The primary fix is upgrading @node-oauth/oauth2-server to version 5.3.0, which enforces RFC 7636 ABNF validation (43-128 unreserved characters) on code_verifier before the hash comparison in the authorization code grant flow. The advisory is available at https://github.com/node-oauth/oauth2-server/security/advisories/GHSA-jhm7-29pj-4xvf. If immediate upgrade is not possible, a specific compensating control is to enforce code_verifier length and charset validation at the application or API gateway layer before requests reach the token endpoint - reject any code_verifier shorter than 43 characters or containing characters outside the RFC 7636 unreserved set. A secondary workaround is to configure the authorization server to invalidate authorization codes after any failed token exchange attempt, removing the retry window; this trades usability (legitimate transient failures also consume the code) for security. There is no compensating control that addresses the format-enforcement gap within the library itself prior to patching.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today