漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Improper Authorization
Vulnerability Description
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability Type
N/A
Vulnerability Title
Google google-oauth-client 安全漏洞
Vulnerability Description
Google google-oauth-java-client（Google OAuth Client Library for Java）是美国谷歌（Google）公司的一款基于Java的Google OAuth（开放授权）客户端库。 Google com.google.oauth-client:google-oauth-client 1.31.0之前版本中存在安全漏洞。攻击者可借助恶意应用程序利用该漏洞获取授权码，从而获取授权，访问受保护的资源。
CVSS Information
N/A
Vulnerability Type
N/A