Expo SDK has an OAuth vulnerability

Description

A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the “Expo AuthSession Redirect Proxy” for social sign-in. This can be achieved once a victim clicks a malicious link.

Recommendation

Update the expo package to the latest compatible version. Followings are version details:

Affected version(s): < 48.0.0
Patched version(s): 48.0.0

References

GHSA-wr5g-q49g-548w
blog.expo.dev
www.darkreading.com
CVE-2023-28131
CWE-522
CAPEC-310
OWASP 2021-A4
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Expo SDK has an OAuth vulnerability and gives you actionable findings to investigate.

Start a free scan

Related Issues

Vega has Cross-site Scripting vulnerability in `lassoAppend` function - vega - CVE-2023-26487
BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability - CVE-2025-69287
Vega has Cross-site Scripting vulnerability in `lassoAppend` function - CVE-2023-26487
Gatsby develop server has Local File Inclusion vulnerability - CVE-2023-34238

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated October 15, 2025