CVE-2020-26938
published 2022-08-29CVE-2020-26938: In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked…
PriorityP338high7.2CVSS 3.1
AVNACLPRNUINSCCLILAN
EPSS
0.76%
51.4th percentile
In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked against an incorrect URI pattern ("[a-zA-Z][a-zA-Z0-9+.-]+:") before making a redirection. This allows a malicious client to pass an XSS payload through the redirect_uri parameter while making an authorization request. NOTE: this vulnerability is similar to CVE-2020-7741.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oauth2-server_project | oauth2-server | <= 3.1.1 | — |
| oauth2-server_project | oauth2-server | 0 – 3.1.1 | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
ghsa9.9CRITICAL
osv9.9CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
oauth2-server through 3.1.1 vulnerable to Open Redirect
ghsa·2022-08-30·CVSS 9.9
CVE-2020-26938 [CRITICAL] CWE-601 oauth2-server through 3.1.1 vulnerable to Open Redirect
oauth2-server through 3.1.1 vulnerable to Open Redirect
In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the `redirect_uri` parameter received during the authorization and token request is checked against an incorrect URI pattern (`[a-zA-Z][a-zA-Z0-9+.-]+:`) before making a redirection. This allows a malicious client to pass an XSS payload through the redirect_uri parameter while making an authorization request. NOTE: this vulnerability is similar to CVE-2020-7741.
OSV
oauth2-server through 3.1.1 vulnerable to Open Redirect
osv·2022-08-30·CVSS 9.9
CVE-2020-26938 [CRITICAL] oauth2-server through 3.1.1 vulnerable to Open Redirect
oauth2-server through 3.1.1 vulnerable to Open Redirect
In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the `redirect_uri` parameter received during the authorization and token request is checked against an incorrect URI pattern (`[a-zA-Z][a-zA-Z0-9+.-]+:`) before making a redirection. This allows a malicious client to pass an XSS payload through the redirect_uri parameter while making an authorization request. NOTE: this vulnerability is similar to CVE-2020-7741.
No detection rules found.
No public exploits indexed.
https://github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/grant-types/authorization-code-grant-type.js#L143https://github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/validator/is.js#L12https://github.com/oauthjs/node-oauth2-server/issues/637https://tools.ietf.org/html/rfc3986#section-3https://tools.ietf.org/html/rfc6749#section-3.1.2https://github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/grant-types/authorization-code-grant-type.js#L143https://github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/validator/is.js#L12https://github.com/oauthjs/node-oauth2-server/issues/637https://tools.ietf.org/html/rfc3986#section-3https://tools.ietf.org/html/rfc6749#section-3.1.2
2022-08-29
Published