CVE-2020-7692: Incorrect Authorization

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized...

Grammarly: Grammarly Keyboard for Android "Authorization Code with PKCE" flow implementation vulnerability that allows account takeover

@tomtenisse identified a vulnerability in Grammarly Keyboard for Android that allowed malicious application installed on the device to guess the PKCE code verifier value and consequently obtain access to OAuth accesstoken grauth cookie. The vulnerability was fixed by moving from PRNG to...