Node Oauth2 Server
Monthly
PKCE code_verifier validation in @node-oauth/oauth2-server (versions <= 5.2.1) does not enforce RFC 7636 ABNF requirements, accepting arbitrarily short values including single-character strings for S256 flows. An attacker who intercepts an authorization code can brute-force the code_verifier online because failed attempts do not consume the code, allowing repeated guesses until token issuance succeeds. A working proof-of-concept is publicly documented in the GitHub security advisory; no active exploitation confirmed in CISA KEV.
PKCE code_verifier validation in @node-oauth/oauth2-server (versions <= 5.2.1) does not enforce RFC 7636 ABNF requirements, accepting arbitrarily short values including single-character strings for S256 flows. An attacker who intercepts an authorization code can brute-force the code_verifier online because failed attempts do not consume the code, allowing repeated guesses until token issuance succeeds. A working proof-of-concept is publicly documented in the GitHub security advisory; no active exploitation confirmed in CISA KEV.