Vulnerability · Published Apr 24, 2023 · Assigned by checkpoint
CVE-2023-28131
Critical 9.6
In plain English
A critical-severity security flaw in Expo AuthSession module from Expo.io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 23.2% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | expo | 48.0.0 | GHSA-wr5g-q49g-548w |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Expo.io | Expo AuthSession module | All versions prior to SDK 48.* (Affected SDK 45.*, 46.* and 47.*) |
Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H