PT-2026-34722 · Npm · Node-Oauth2-Server

Karimtantawey · Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-41213

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions @node-oauth/oauth2-server (affected versions not specified)

Description The token exchange path accepts invalid code verifier values, including one-character strings, for S256 PKCE (Proof Key for Code Exchange) flows, which contradicts RFC7636. Since short or weak verifiers are permitted and failed attempts do not invalidate the authorization code, an attacker who intercepts an authorization code can perform an online brute-force attack on code verifier guesses to obtain a token.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-1289

CWE-307

Related Identifiers

CVE-2026-41213

GHSA-JHM7-29PJ-4XVF

Affected Products

Node-Oauth2-Server

References · 5

• 🔥 https://github.com/node-oauth/node-oauth2-server/security/advisories/GHSA-jhm7-29pj-4xvf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41213 · Security Note
• https://osv.dev/vulnerability/GHSA-jhm7-29pj-4xvf · Vendor Advisory
• https://github.com/node-oauth/node-oauth2-server · Note
• https://twitter.com/CVEnew/status/2047428087181344861 · Twitter Post