Executive brief
The oauth2-server library, used to implement OAuth 2.0 authentication in Node.js applications, lacks support for a security extension called PKCE (Proof Key for Code Exchange). This omission could allow an attacker to intercept and reuse authorization codes to gain unauthorized access to user accounts or data. While the vendor disputes that this is a flaw in the library itself, modern security standards recommend PKCE to prevent such interception attacks.
Technical details
The oauth2-server (aka node-oauth2-server) package through version 3.1.1 fails to implement RFC 7636 (Proof Key for Code Exchange, or PKCE). This lack of PKCE support allows for authorization code injection attacks, where an attacker can intercept an authorization code and exchange it for an access token without possessing the original secret 'code_verifier'. The vulnerability is particularly relevant for public clients (like mobile or single-page apps) where client secrets cannot be securely stored. Although the vendor disputes the classification as a vulnerability, citing that PKCE is an optional extension to RFC 6749, it is considered a significant security omission in modern OAuth 2.0 implementations. A pull request for PKCE support was initiated but remained unmerged in the affected versions.
Affected products
- oauthjs oauth2-server up to and including 3.1.1
Timeline
- 2017-10-28: other: Initial pull request for PKCE support submitted
- 2020-10-04: disclosed: NVD published the vulnerability record
- 2021-04-22: advisory: GitHub advisory published