Log in Start free

Vulnerability · Published Jul 9, 2020 · Assigned by snyk

CVE-2020-7692Improper Authorization

High 7.4

In plain English

A high-severity security flaw in com.google.oauth-client:google-oauth-client. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)1.5%top 25.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12google-oauth-client-java1.28.0-2DEBIAN-CVE-2020-7692
Debian:13google-oauth-client-java1.28.0-2DEBIAN-CVE-2020-7692
Debian:14google-oauth-client-java1.28.0-2DEBIAN-CVE-2020-7692
Mavencom.google.oauth-client:google-oauth-client1.31.0GHSA-f263-c949-w85g
Ubuntu:22.04:LTSgoogle-oauth-client-javano fix listedUBUNTU-CVE-2020-7692
Ubuntu:24.04:LTSgoogle-oauth-client-javano fix listedUBUNTU-CVE-2020-7692
Ubuntu:25.10google-oauth-client-javano fix listedUBUNTU-CVE-2020-7692
Ubuntu:26.04:LTSgoogle-oauth-client-javano fix listedUBUNTU-CVE-2020-7692
Ubuntu:26.10google-oauth-client-javano fix listedUBUNTU-CVE-2020-7692

Affected products (as reported)

VendorProductVersions
n/a com.google.oauth-client:google-oauth-client unspecified – before 1.31.0

References