CVE-2026-41213
CWE-307Published: April 23, 2026· Updated: Apr 25, 2026
Official Description
@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.
Technical Analysis
CVE-2026-41213 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.9.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
All References (2)
Quick Facts
Related CVEs (CWE-307)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-41213 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts