CVE-2017-18924: 
JavaScript vulnerability analysis and mitigation

oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE (Proof Key for Code Exchange), making it susceptible to authorization code interception attacks. The vulnerability is disputed as the vendor states that since RFC7636 (PKCE) is an extension, the claim of 'RFC 6749 compliant' in the README is valid and they don't consider this a vulnerability per se (NVD).

The vulnerability stems from the lack of PKCE implementation, which is a security extension designed to prevent authorization code interception attacks in OAuth 2.0 public clients. PKCE works by having the client create a secret code verifier and its transformed version (code challenge) that is sent with the authorization request. The authorization server associates these values with the authorization code, requiring the client to prove possession of the original code verifier when exchanging the authorization code for tokens (OAuth Security BCP, RFC7636).

Without PKCE implementation, public clients using the Authorization Code Grant flow are vulnerable to authorization code interception attacks. An attacker who intercepts the authorization code can potentially exchange it for access tokens, gaining unauthorized access to protected resources (OAuth Security BCP).

The vulnerability can be exploited if an attacker can intercept the authorization code during the OAuth flow. This is particularly concerning for public clients like mobile or single-page applications where client secrets cannot be securely stored. A proof of concept has been discussed in the project's issue tracker (GitHub Issue).

A pull request implementing PKCE support has been created but not yet merged into the main codebase (GitHub PR). As a workaround, developers can implement their own PKCE verification logic or use alternative OAuth 2.0 server implementations that support PKCE. The OAuth Security Best Current Practice strongly recommends using PKCE for all OAuth clients, not just mobile applications (OAuth Security BCP).

The security community has emphasized the importance of PKCE, with experts recommending its use for all OAuth clients, not just mobile applications. This is reflected in articles discussing OAuth 2.0 security best practices (Missing Point Article).