CVE-2026-41213: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41213 is a PKCE code_verifier validation bypass in @node-oauth/oauth2-server, a Node.js OAuth2 server implementation. The token exchange endpoint fails to enforce RFC 7636 ABNF requirements, accepting arbitrarily short or weak code_verifier values (including single-character strings) for S256 PKCE flows. All versions up to and including 5.2.1 are affected; the issue was published on April 23, 2026, and patched in version 5.3.0. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory).

The root cause lies in two files: lib/pkce/pkce.js (getHashForCodeChallenge) only verifies that the code_verifier is a non-empty string before hashing it for S256, without enforcing the RFC 7636 ABNF requirement of 43–128 unreserved characters (CWE-1289). Additionally, lib/grant-types/authorization-code-grant-type.js compares hash(code_verifier) to the stored codeChallenge without validating verifier format or length, and — critically — authorization code revocation occurs after verifier validation, meaning failed guesses do not consume the code (CWE-307). This allows an attacker who has intercepted a valid authorization code to submit unlimited brute-force guesses against the token endpoint until a matching code_verifier is found (GitHub Advisory).

An attacker who intercepts an authorization code — for example, via a redirect URI interception or network eavesdropping — can brute-force the code_verifier online and successfully exchange the code for bearer access tokens. This results in unauthorized access to OAuth2-protected resources with high confidentiality impact, as the attacker gains the same token privileges as the legitimate user. Integrity and availability are not directly impacted, but token theft can enable account takeover, data exfiltration, and lateral movement into downstream services protected by the OAuth2 server (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including a step-by-step HTTP request template and confirmed PoC output showing successful token issuance after 26 guesses against a single-character verifier (GitHub Advisory). Exploitation requires the attacker to first intercept a valid authorization code, making the attack complexity high (AC:H). No in-the-wild exploitation has been reported as of the time of publication, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.047%, reflecting low but non-zero exploitation probability.

1. Intercept an authorization code: Position to capture a valid authorization code issued by the vulnerable OAuth2 server — e.g., via redirect URI manipulation, network interception, or referrer header leakage.
2. Identify PKCE flow: Confirm the authorization request used code_challenge_method=S256, indicating a PKCE flow where a code_verifier is required for token exchange.
3. Begin brute-force loop: Send repeated POST /token requests with incrementally guessed code_verifier values (starting with single characters a–z, then expanding):

POST /token HTTP/1.1
Host: oauth.example
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&client_id=client1&client_secret=s3cret&code=stolen-auth-code&redirect_uri=https://client.example/callback&code_verifier=<guess>

4. Observe responses: Failed guesses return invalid_grant; the authorization code is NOT consumed on failure, allowing unlimited retries.
5. Achieve token issuance: When the guessed code_verifier matches the stored codeChallenge (e.g., code_verifier=z after 26 attempts), the server returns bearer tokens, completing the attack (GitHub Advisory).

• Network: High volume of POST /token requests from a single IP or user-agent with the same code parameter but varying code_verifier values; repeated invalid_grant responses followed by a successful 200 OK token response.
• Logs: OAuth2 server access logs showing many failed token exchange attempts (HTTP 400 with invalid_grant) for the same authorization code within a short time window, culminating in a successful token issuance.
• Application Behavior: Authorization codes being redeemed by a client IP or user-agent that differs from the one that originally initiated the authorization request, suggesting code interception and replay.

Upgrade @node-oauth/oauth2-server to version 5.3.0 or later, which enforces RFC 7636 ABNF validation (43–128 unreserved characters) on code_verifier before hashing and comparison (GitHub Advisory). As interim mitigations, implement rate limiting or strict retry limits on the token exchange endpoint to prevent online brute-forcing, and ensure that authorization codes are invalidated upon any failed verifier attempt. Additionally, enforce that OAuth2 clients generate cryptographically random code_verifier values of at least 43 characters as required by RFC 7636.

The advisory was published by maintainer jankapunkt on April 15, 2026, with credit to reporter KarimTantawey and remediation reviewer dhensby. No significant broader media coverage or notable public researcher commentary beyond the GitHub advisory has been identified at this time (GitHub Advisory).