Maven package
com.google.oauth-client/google-oauth-client
pkg:maven/com.google.oauth-client/google-oauth-client
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-22573 | — | >= 1.16.0-rc, < 1.33.3 | 1.33.3 | May 3, 2022 | The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pas | ||
| CVE-2020-7692 | — | < 1.31.0 | 1.31.0 | Jul 9, 2020 | PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that w |
- CVE-2021-22573May 3, 2022affected >= 1.16.0-rc, < 1.33.3fixed 1.33.3
The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pas
- CVE-2020-7692Jul 9, 2020affected < 1.31.0fixed 1.31.0
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that w