Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

com.google.oauth-client:google-oauth-client

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.3MavenPublished

    google-oauth-java-client improperly verifies cryptographic signature

    CVE-2021-22573 · GHSA-hw42-3568-wj87

    Affected
    • Maven com.google.oauth-client:google-oauth-client >= 1.16.0-rc, < 1.33.3
    Fixed in
    1.33.3· Vendor fix available
    Issue
    The vulnerability impacts only users of the IdTokenVerifier class. The verify method in IdTokenVerifier does not validate the signature before verifying the claims (e.g., iss, aud, etc.). Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with modified payload like email or phone number. The token will pass the validation by the library. Once verified, modified payload can be used by the application. If the application sends verified IdToken to other service as is like for auth - the risk is low, because the backend of the service is expected to check the signature and fail the request. Reporter: Tamjid al Rahat, contributor Patches The issue was fixed in the 1.33.3 version of the library Proof of Concept To reproduce, one needs to call the verify function with an IdToken instance that contains a malformed signature to successfully bypass the checks inside the verify…

    Recommended action: Upgrade to 1.33.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.4MavenPublished

    Improper Authorization in Google OAuth Client

    CVE-2020-7692 · GHSA-f263-c949-w85g

    Affected
    • Maven com.google.oauth-client:google-oauth-client < 1.31.0
    Fixed in
    1.31.0· Vendor fix available
    Issue
    PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.

    Recommended action: Upgrade to 1.31.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →