Vulnerability in OAuth2 Implementation by Node.js

CVE-2026-41213

What is CVE-2026-41213?

The OAuth2 server module for Node.js is susceptible to a vulnerability where it allows the use of RFC7636-invalid code_verifier values, including single-character strings for the S256 PKCE flow. This lenient validation enables attackers to intercept authorization codes and perform brute-force attacks on code_verifier guesses without exhausting the authorization code. As a result, successful token issuance becomes achievable, highlighting a significant risk to applications using this module.

References