Medium, CVSS 5.9npmAmendedPublished
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
CVE-2026-41213 · GHSA-jhm7-29pj-4xvf
- Affected
- npm @node-oauth/oauth2-server <= 5.2.1
- Fixed in
- 5.3.0· Vendor fix available
- Issue
- The token exchange path accepts RFC7636-invalid codeverifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force codeverifier guesses online until token issuance succeeds. Root cause 1. lib/pkce/pkce.js (getHashForCodeChallenge) only checks that verifier is a non-empty string before hashing for S256; it does not enforce RFC7636 ABNF (43..128 unreserved chars). 2. lib/grant-types/authorization-code-grant-type.js compares hash(codeverifier) to stored codeChallenge without validating verifier format/length. 3. In AuthorizationCodeGrantType.handle, authorization code revocation happens after verifier validation. Invalid guesses fail before revoke, so the same code can be retried repeatedly. Steps to Reproduce Setup - PKCE authorization code exists with: - codeChallengeMethod = "S256" -…
Recommended action: Upgrade to 5.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.