GitHub Advisoryadvisory · Maven

GHSA-f263-c949-w85g Improper Authorization in Google OAuth Client

HIGH Published 2021-09-28 Modified 2021-09-28 Official page ↗
Aliases
CVE-2020-7692
Ecosystem
Maven
Packages
com.google.oauth-client:google-oauth-client
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-862, CWE-863
Reviewed
2021-09-28

Affected packages

• Maven com.google.oauth-client:google-oauth-client: < 1.31.0 → fixed in 1.31.0

Description

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.

Related

Alias · CVE (1)

  • CVE-2020-7692 PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. vulnerability

Weakness · CWE (2)

  • CWE-862 Missing Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References