CVE-2021-22573 Incorrect signature verification on Google-oauth-java-client
Attackers can bypass authentication by providing unsigned ID tokens with custom payloads, allowing unauthorized access to applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-22573?
CVE-2021-22573 is a high-severity authentication bypass vulnerability in Google-oauth-java-client, published on 3 May 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above
Weakness: CWE-347
Which versions are affected by CVE-2021-22573?
2 open source packages ship an affected version, including com.google.oauth-client:google-oauth-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.google.oauth-client:google-oauth-client Maven | From 1.16.0-rc | 1.33.3 |
com.google.oauth-client:google-oauth-client Maven | From 1.16.0-rc | 1.33.3 |
Linux distribution packages (1)
google-oauth-java-client openSUSE:Leap 15.5 | All versions | 1.22.0-150200.3.7.1 |
Products include Google Oauth Client Library for Java.
How do I fix CVE-2021-22573?
Upgrade com.google.oauth-client:google-oauth-client to 1.33.3 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-22573 being exploited?
There is no known exploitation of CVE-2021-22573 in the wild and no public exploit code.
Other vulnerabilities in Google-oauth-java-client
Sources
Also known as CLSA-2026-1770682155, DEBIAN-CVE-2021-22573, GHSA-hw42-3568-wj87, OESA-2025-2429, OESA-2025-2430, OESA-2025-2431 and 5 more.