{"id":"EUVD-2026-25272","enisaUuid":"35d2bf91-fe13-3bcb-9911-c0b8173fa42e","description":"@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.","datePublished":"Apr 23, 2026, 6:33:42 PM","dateUpdated":"Apr 25, 2026, 1:23:58 AM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/node-oauth/node-oauth2-server/security/advisories/GHSA-jhm7-29pj-4xvf\n","aliases":"CVE-2026-41213\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"2b1fd32c-6eeb-33cd-8bbc-927ec8a7f003","product":{"name":"node-oauth2-server","vendor":{"name":"node-oauth"}},"product_version":"\u003c 5.3.0"}],"enisaIdVendor":[{"id":"1a57af31-ff54-3a34-9d46-803e60742d6c","vendor":{"name":"node-oauth"}}],"enisaIdVulnerability":[{"id":"73afb9e3-f62c-3104-9c35-09f26934536f","vulnerability":{"id":"CVE-2026-41213","description":"@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.","datePublished":"Apr 23, 2026, 6:33:42 PM","dateUpdated":"Apr 25, 2026, 1:23:58 AM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/node-oauth/node-oauth2-server/security/advisories/GHSA-jhm7-29pj-4xvf\n","enisa_id":"EUVD-2026-25272\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"c647ef35-175a-3d1e-aaea-80a83941dd87","product":{"name":"node-oauth2-server","vendor":{"name":"node-oauth"}},"product_version":"\u003c 5.3.0"}],"vulnerabilityVendor":[{"id":"dff73c87-0f28-37b4-9d4f-e978637ee47a","vendor":{"name":"node-oauth"}}]}}],"enisaIdAdvisory":[]}