PT-2023-2946 · Unknown · Expo Framework

Published 2023-04-24 · Updated 2025-10-16 · CVE-2023-28131

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Expo framework (affected versions not specified)

Description The issue is related to the implementation of the OAuth standard in the Expo framework, specifically with insufficient protection of registration data. An attacker can exploit this to take over accounts and steal credentials on an application or website that has configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link, which may be sent via various means such as email, text message, or an attacker-controlled website.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2023-02954

CVE-2023-28131

GHSA-WR5G-Q49G-548W

Affected Products

Expo Framework

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2023-28131 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28131 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wr5g-q49g-548w · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02954 · Security Note
• https://github.com/expo/expo · Note
• https://t.me/cvenotify/49656 · Telegram Post
• https://darkreading.com/endpoint/oauth-flaw-in-expo-platform-affects-hundreds-of-third-party-sites-apps · Note
• https://blog.expo.dev/security-advisory-for-developers-using-authsessions-useproxy-options-and-auth-expo-io-e470fe9346df · Note
• https://twitter.com/pHo9UBenaA/status/1978832985601270050 · Twitter Post
• https://t.me/cvenotify/109907 · Telegram Post
• https://t.me/cvenotify/48911 · Telegram Post
• https://t.me/cybersecuritytechnologies/8371 · Telegram Post
• https://t.me/pentestingnews/36346 · Telegram Post