Skip to content

Product

debian/google-oauth-client-java vulnerabilities

2 published CVES affecting debian/google-oauth-client-java, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
1
High
1
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest debian/google-oauth-client-java CVEs

Newest publication first

  1. CVE-2021-22573 Incorrect signature verification on Google-oauth-java-client

    Published
    HighCVSS 7.3 EPSS 0.30%

    The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pas...

  2. CVE-2020-7692 Improper Authorization

    Published
    CriticalCVSS 9.1 EPSS 1.5%

    PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that w...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.