Description
An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their own apps.
References (1)
Core 1
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/ScratchVerifier/ScratchOAuth2/commit/d856dc704b2504cd3b92cf089fdd366dd40775d6
Scores
CVSS v3
6.5
EPSS
0.0015
EPSS Percentile
35.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-639
Status
published
Products (1)
scratchoauth2_project/scratchoauth2
< 2021-04-12
Published
Feb 15, 2022
Tracked Since
Feb 18, 2026