-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper URI validation in two key functions: 1) The authorization code grant type's redirect URI validation uses a flawed regex that doesn't properly check URI structure. 2) The is.uri validator implements an RFC-noncompliant pattern ([a-zA-Z][a-zA-Z0-9+.-]+:), missing critical validation of authority/path components. Together these allow injection of malicious redirect URIs. The code references and CVE analysis explicitly point to these functions/locations as the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| oauth2-server | npm | <= 3.1.1 |