The Oauth2 Server Project maintains a focused open-source OAuth 2.0 authorization server implementation, a narrowly scoped but strategically important component in authentication and delegation workflows across web and mobile applications. Its observed vulnerability signal centers on missing authorization controls, reflecting the access-enforcement complexity inherent to an authorization-server codebase where flaws can undermine downstream application security. Current vulnerability counts and severity details are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Oauth2 Server Project over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-31691CRITICAL Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0. | Mar 31, 2025 | 9.8 | 25 | NO | NO |
CVE-2017-18924HIGH oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: th | Oct 4, 2020 | 7.5 | 25 | NO | NO |
CVE-2020-26938HIGH In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked against an incorrect | Aug 29, 2022 | 7.2 | 24 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Oauth2 Server Project.
Media articles that mention a CVE ID that affects a product developed by Oauth2 Server Project — matched by CVE ID, not by vendor name.