CVE-2026-41213 @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
Attackers can brute-force PKCE code_verifiers to redeem intercepted authorization codes and gain unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41213?
CVE-2026-41213 is a medium-severity vulnerability in node-oauth2-server, published on 23 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.
Which versions are affected by CVE-2026-41213?
2 open source packages ship an affected version, including @node-oauth/oauth2-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@node-oauth/oauth2-server npm | All versions | 5.3.0 |
@node-oauth/oauth2-server npm | All versions | 5.3.0 |
Products include Node-Oauth Node-Oauth\/Oauth2-Server.
How do I fix CVE-2026-41213?
Upgrade @node-oauth/oauth2-server to 5.3.0 or later.
Is CVE-2026-41213 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41213 exists.
Sources
Also known as GHSA-jhm7-29pj-4xvf.