@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

过多认证尝试的限制不恰当

@node-oauth/oauth2-server 安全漏洞

@node-oauth/oauth2-server是node-oauth开源的一个符合RFC标准的Node.js OAuth2服务器实现模块。 @node-oauth/oauth2-server存在安全漏洞，该漏洞源于token交换路径接受RFC7636无效的code_verifier值，可能导致暴力破解攻击。

N/A

N/A