Description
A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the “Expo AuthSession Redirect Proxy” for social sign-in. This can be achieved once a victim clicks a malicious link.
Recommendation
Update the expo package to the latest compatible version. Followings are version details:
- Affected version(s): < 48.0.0
- Patched version(s): 48.0.0
References
- GHSA-wr5g-q49g-548w
- blog.expo.dev
- www.darkreading.com
- CVE-2023-28131
- CWE-522
- CAPEC-310
- OWASP 2021-A4
- OWASP 2021-A6
Related Issues
- Parse Server has an OAuth login vulnerability - CVE-2025-30168
- Vega has Cross-site Scripting vulnerability in `lassoAppend` function (GHSA-w5m3-xh75-mp55) - CVE-2023-26487
- Vega has Cross-site Scripting vulnerability in `lassoAppend` function - CVE-2023-26487
- Gatsby develop server has Local File Inclusion vulnerability - CVE-2023-34238
- Tags:
- npm
- expo
Anything's wrong? Let us know Last updated on October 15, 2025