GitHub Advisoryadvisory · npm

GHSA-wr5g-q49g-548w Expo SDK has an OAuth vulnerability

CRITICAL Published 2023-04-24 Modified 2025-10-15 Official page ↗
Aliases
CVE-2023-28131
Ecosystem
npm
Packages
expo
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-522
Reviewed
2025-10-15

Affected packages

• npm expo: < 48.0.0 → fixed in 48.0.0

Description

A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc).

Related

Alias · CVE (1)

  • CVE-2023-28131 A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References