Executive brief
react-oauth-flow is a JavaScript library that handles OAuth authentication in web applications. The library fails to properly implement OAuth security by storing sensitive OAuth client secrets in front-end code instead of keeping them server-side, allowing attackers to extract and misuse these credentials to compromise server security and authentication flows.
Technical details
react-oauth-flow implements OAuth authentication incorrectly by storing confidential OAuth client secrets in browser-accessible code rather than restricting them to a secure server-side implementation. The vulnerability stems from a fundamental OAuth protocol misunderstanding: the library uses a confidential client (which requires secrets) in the browser, where secrets are exposed to client-side code inspection. This allows any attacker with access to the browser (via XSS, source code inspection, or network interception) to extract the client credentials. An attacker who obtains these secrets can impersonate the legitimate application to the OAuth provider, potentially gaining unauthorized access to user accounts or server resources. As of the advisory publication, no patch is available; users are advised to migrate to alternative OAuth libraries that properly implement the protocol.
Affected products
- react-oauth-flow react-oauth-flow all versions
Timeline
- 2020-09-03: disclosed