Improper Authorization in react-oauth-flow

Description

All versions of react-oauth-flow fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise server credentials.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 0.0.0

References

• GHSA-65m9-m259-7jqw
• www.npmjs.com
• CWE-285
• OWASP 2021-A1

Related Issues

• Improper Authorization in @sap-cloud-sdk/core - Vulnerability
• MCPHub has an Improper Authorization vulnerability via its handleSseConnection function - CVE-2025-11287
• Expo SDK has an OAuth vulnerability - CVE-2023-28131
• Cross-Site Scripting in react-marked-markdown - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

react-oauth-flow