Vulnerability Details : CVE-2020-26938
Potential exploit
In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked against an incorrect URI pattern ("[a-zA-Z][a-zA-Z0-9+.-]+:") before making a redirection. This allows a malicious client to pass an XSS payload through the redirect_uri parameter while making an authorization request. NOTE: this vulnerability is similar to CVE-2020-7741.
Vulnerability category: Cross site scripting (XSS)Open redirect
Products affected by CVE-2020-26938
- cpe:2.3:a:oauth2-server_project:oauth2-server:*:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-26938
0.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 37 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-26938
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
3.9
|
2.7
|
NIST |
CWE ids for CVE-2020-26938
-
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-26938
-
https://tools.ietf.org/html/rfc6749#section-3.1.2
RFC 6749: The OAuth 2.0 Authorization FrameworkThird Party Advisory
-
https://github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/validator/is.js#L12
node-oauth2-server/is.js at 91d2cbe70a0eddc53d72def96864e2de0fd41703 · oauthjs/node-oauth2-server · GitHubExploit;Third Party Advisory
-
https://tools.ietf.org/html/rfc3986#section-3
RFC 3986: Uniform Resource Identifier (URI): Generic SyntaxThird Party Advisory
-
https://github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/grant-types/authorization-code-grant-type.js#L143
node-oauth2-server/authorization-code-grant-type.js at 91d2cbe70a0eddc53d72def96864e2de0fd41703 · oauthjs/node-oauth2-server · GitHubExploit;Third Party Advisory
-
https://github.com/oauthjs/node-oauth2-server/issues/637
Multiple Security Vulnerabilities in Auth and Token Endpoint · Issue #637 · oauthjs/node-oauth2-server · GitHubIssue Tracking;Third Party Advisory
Jump to