Description
All versions of react-oauth-flow fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise server credentials.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 0.0.0
References
Could your website be exposed too?
SmartScanner can check your website for Improper Authorization in react-oauth-flow and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Improper Authorization in @sap-cloud-sdk/core - Vulnerability
- MCPHub has an Improper Authorization vulnerability via its handleSseConnection function - CVE-2025-11287
- Expo SDK has an OAuth vulnerability - CVE-2023-28131
- Cross-Site Scripting in react-marked-markdown - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023