Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
oauth2-server 代码注入漏洞
Vulnerability Description
oauth2-server是个人开发者的一个符合标准的用 PHP 编写的 OAuth 2.0 授权服务器的实现。为应用程序提供身份验证和授权功能，保护API安全。 oauth2-server 3.1.1存在代码注入漏洞。
CVSS Information
N/A
Vulnerability Type
N/A