CVE-2023-28131

A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to th...

The vulnerability of the OAuth implementation of the Expo framework is related to insufficient protection of registration data, allowing attackers to obtain user registration data.

The vulnerability of the OAuth implementation of the Expo framework is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain user registration data...

Critical OAuth Vulnerability in Expo Framework Allows Account Hijacking

A critical security vulnerability has been disclosed in the Open Authorization OAuth implementation of the application development framework Expo.io. The shortcoming, assigned the CVE identifier CVE-2023-28131, has a severity rating of 9.6 on the CVSS scoring system. API security firm Salt Labs...

Expo SDK has an OAuth vulnerability

A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to th...

CVE-2023-28131

A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to th...

PT-2023-2946 · Unknown · Expo Framework

Name of the Vulnerable Software and Affected Versions: Expo framework affected versions not specified Description: The issue is related to the implementation of the OAuth standard in the Expo framework, specifically with insufficient protection of registration data. An attacker can exploit this t...