CVE-2026-41213
1 advisory.
npm/@node-oauth/oauth2-server CVE-2026-41213: medium 5.9, EPSS 0.35%
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
Action: Upgrade @node-oauth/oauth2-server to 5.3.0 or later.
npm i @node-oauth/oauth2-server@5.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.3.0 | - |
Fixed versions
| 5.3.0 |
Sources
- osv: GHSA-jhm7-29pj-4xvf
- https://github.com/node-oauth/node-oauth2-server/security/advisories/GHSA-jhm7-29pj-4xvf
- https://nvd.nist.gov/vuln/detail/CVE-2026-41213
- https://github.com/node-oauth/node-oauth2-server
CVE-2026-41213 · published · modified · JSON