CVE-2026-41213: @node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7…
@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.
- Published by source
- 2026-04-23
- First seen by Reality Radar
- 2026-10-27
- Last verified
- 2026-10-27
Affected
- Manufacturer
- node-oauth
- Products
- node-oauth\/oauth2-server
- Versions
- <5.3.0
- CPE
- cpe:2.3:a:node-oauth:node-oauth\/oauth2-server:*:*:*:*:*:node.js:*:*
Whether your exact unit is affected depends on the model, serial number and region in the official notice.
What the official notice says
Risk: CVSS 5.9
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-04-23
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #2151 | new | 2026-10-27 | 44a7cbec2bdc…1ee6c7 | 92b542872329…c4b5bc |
Chain head: #2286 e212558e872c…954bc1