CVE-2020-7692
HIGHGoogle OAuth Client Library for Java < 1.31.0 - Incorrect Authorization via Missing PKCE Implementation
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2020-7692. PoCs published by dawetmaster, andikahilmy.
AI-analyzed exploit summary The repository contains only GitHub issue templates, CI/CD scripts, and build configurations for the Google OAuth Java client. There is no exploit code, vulnerability analysis, or proof-of-concept related to CVE-2020-7692.
Description
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
Exploits (2)
The repository contains only GitHub issue templates, CI/CD scripts, and build configurations for the Google OAuth Java client. There is no exploit code, vulnerability analysis, or proof-of-concept related to CVE-2020-7692.
The repository contains only GitHub issue templates, CI/CD scripts, and build configurations for the Google OAuth Java client library. No exploit code, vulnerability details, or proof-of-concept related to CVE-2020-7692 are present.
References (7)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N