Executive brief
passport-oauth2 is a Node.js library that authenticates users via OAuth2 providers. The library fails to properly validate whether an access token was successfully obtained when an OAuth provider returns HTTP 200 status but indicates an authentication failure. An attacker could exploit certain misconfigured identity providers to bypass authentication and gain unauthorized access to an application.
Technical details
passport-oauth2 versions before 1.6.1 suffer from improper access control (CWE-287) in token validation. The vulnerability exists because the library's getOAuthAccessToken() method only treats HTTP error status codes as failures; if a non-compliant OAuth provider returns HTTP 200 but provides no valid access token, the library still grants authentication. An attacker can exploit this in applications that trust the access token's presence without validating its actual value, particularly when the identity provider uses HTTP 200 for error responses. The fix (merged in v1.6.1) adds explicit validation to ensure an access token was actually returned. Exploitation requires a non-standard OAuth provider and an application that grants access based solely on token presence.
Affected products
- Jared Hanson passport-oauth2 before 1.6.1
Timeline
- 2021-09-29: disclosed: Advisory published
- 2021-09-24: patched: Fix merged in v1.6.1