Oauth2 Server
Vendor:
First CVE: Oct 4, 2020 · Active for 5 years
3
Total CVEs
More Total CVEs than 64% of tracked products
1.0
Avg CVEs / Year
Bottom 1%
8.2
Avg CVSS
Higher Avg CVSS than 72% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Oauth2 Server over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 4, 2020
5 years ago
Most Recent CVE
Mar 31, 2025
483 days ago
CVE Severity & Scoring
Oauth2 Server3 CVEs
67%
33%
All CVEs352,719 CVEs
45%
40%
11%
HighCritical
Attack Vector
Local0 (0.0%)
Network3 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low3 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None3 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None3 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-31691CRITICAL Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0. | Mar 31, 2025 | 9.8 | 25 | NO | NO |
CVE-2017-18924HIGH oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: th | Oct 4, 2020 | 7.5 | 25 | NO | NO |
CVE-2020-26938HIGH In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked against an incorrect | Aug 29, 2022 | 7.2 | 24 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (3 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (3 CVEs).
Media Mentions
Signals from CVEs in this product scope (3 CVEs).
Top CNAs Publishing CVEs For Oauth2 Server
Top CWEs
Versions
No cataloged versions.