GHSA-35m9-986f-rhmh: 
Rust vulnerability analysis and mitigation

Summary

The OAuth2 authorization_code grant did not check the client secret.

Impact

redemption of an authorization code for a confidential client without its secret.

Affected versions

auth-framework 0.5.0-rc1 through 0.5.0-rc65 and 0.6.0-rc41 through 0.6.0-rc45 (published versions only). PATCHED VERSIONS: 0.6.0-rc46 and later on the 0.6 line (commit 04a4f482, 2026-10-09; #140); on release/0.5.x 0.5.0-rc69 (PR #323), carried by the final release 0.5.0-rc71. Reasoning: POST /oauth/token with grant_type authorization_code only checked that SOME client_secret was present (req.client_secret.is_none()), never that it matched the registered secret of a confidential client. An attacker who holds a valid authorization code for a confidential client (for example one captured from a redirect or a log) and that client's public client_id could redeem it, supplying any secret string, which is exactly what client authentication (RFC 6749 section 3.2.1) exists to prevent. AC:H because the attacker needs the single-use code in time (it is also bound to the redirect_uri and, if used, PKCE). The result is an access token (and refresh token) for the user who authorised the client: C:H/I:H. Reachability: POST /oauth/token (src/api/server.rs). Public clients (registered without a secret) are unchanged: they identify themselves by client_id and must use PKCE. Not affected: 0.1.1-0.4.43 (no src/api/oauth2.rs), 0.6.0-rc46 and later. Measured set (18 of the 71 published .crate files; census API total 71, 71 fetched): 0.5.0-rc1, 18, 19, 25, 26, 27, 31, 45, 49, 51, 53, 60, 62, 63, 65; 0.6.0-rc41, 42, 45. Method: src/api/oauth2.rs of each tarball searched for the code-exchange flow (oauth2_code:) and for fn authenticate_token_client; the 18 above have the flow and lack the function; the 30 versions 0.6.0-rc46..rc150 have it; 22 yanked 0.1-0.4.x tarballs and 0.4.43 have no such file. Unpublished versions between are placed by source order only.

Patches

0.6.0-rc46 and later on the 0.6 line (commit 04a4f482, #140), and 0.5.0-rc71 on the 0.5 line (the change itself: 0.5.0-rc69, PR #323). The fix authenticates the client before the code is read; a failed authentication neither reveals nor consumes the code; a code issued to another client is refused and left intact. 0.5.0-rc65, the only live affected version, is yanked; the other 17 affected versions were yanked earlier. First published fixed versions: 0.5.0-rc71 (tag v0.5.0-rc71) on the 0.5 line; the 0.6 line has been fixed since 0.6.0-rc46.

Workarounds

upgrade; require PKCE for every client (a code bound to a PKCE challenge cannot be redeemed without the verifier). Credits: none (reported publicly as #140, closed 2026-10-09 on main).