@abramltd/jwt-oauth2-middleware (0.1.0), @aerocorp/cli (7.0.5) +143 more potentially affected by CVE-2020-26938 via oauth2-server (>=3.0.0, <=3.1.1)

oauth2-server NPM version =3.0.0, =1.0.0, =0.0.1, =2.1.0, =3.0.0, =0.4.1, =0.1.0, =3.0.0, =3.0.0, =3.5.8 and more Source cves: CVE-2020-26938 Source advisory: OSV:GHSA-4RG6-FM25-GC34...

CVE-2020-26938

CVE-2020-26938 affects oauth2-server/node-oauth2-server

CVE-2020-26938

In oauth2-server aka node-oauth2-server through 3.1.1, the value of the redirecturi parameter received during the authorization and token request is checked against an incorrect URI pattern "a-zA-Za-zA-Z0-9+.-+:" before making a redirection. This allows a malicious client to pass an XSS payload...