medium5.9
CVE-2026-41213
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
Impact
@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @node-oauth/oauth2-server | <= 5.2.1 | 5.3.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Node-Oauth | Node-Oauth\/Oauth2-Server | before 5.3.0 |