CVE-2026-41213 @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid codeverifier values including one-character strings for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the...

@appwise/oauth2-server (>=0.0.19, <=0.2.2), @dyne/slangroom-chain (>=1.4.0, <=1.16.10) +4 more potentially affected by CVE-2026-41213 via @node-oauth/oauth2-server (>=5.0.0, <=5.2.1)

@node-oauth/oauth2-server NPM version =5.0.0, =0.0.19, =1.4.0, =1.3.0, =1.49.1, =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2026-41213 Source advisory: OSV:GHSA-JHM7-29PJ-4XVF...

@appwise/oauth2-server (>=0.0.19, <=0.2.2), @dyne/slangroom-chain (>=1.4.0, <=1.16.10) +4 more potentially affected by CVE-2026-41213 via @node-oauth/oauth2-server (>=5.0.0, <=5.2.1)

@node-oauth/oauth2-server NPM version =5.0.0, =0.0.19, =1.4.0, =1.3.0, =1.49.1, =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2026-41213 Source advisory: SNYK:JS-NODEOAUTHOAUTH2SERVER-16420261...

Malicious code in node-oauth-walkthrough (npm)

The package node-oauth-walkthrough was found to contain malicious code...

MAL-2025-27636 Malicious code in node-oauth-walkthrough (npm)

The package node-oauth-walkthrough was found to contain malicious code...

GHSA-4RG6-FM25-GC34 oauth2-server through 3.1.1 vulnerable to Open Redirect

In oauth2-server aka node-oauth2-server through 3.1.1, the value of the redirecturi parameter received during the authorization and token request is checked against an incorrect URI pattern a-zA-Za-zA-Z0-9+.-+: before making a redirection. This allows a malicious client to pass an XSS payload...