com.google.oauth-client:google-oauth-client

Maven2 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting com.google.oauth-client:google-oauth-clientpage 1 of 1

CVE-2020-7692HIGHCVSS 7.4EG 7.4✓ Fixed in 1.31.0
2020-07-09
vulnerable: 1.10.0-beta ... 1.9.0-beta (38 versions)
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initia…
CVE-2021-22573HIGHCVSS 8.7EG 8.7✓ Fixed in 1.33.3
2022-05-03
vulnerable: 1.16.0-rc ... 1.33.2 (31 versions)
The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised toke…

Check whether com.google.oauth-client:google-oauth-client is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for com.google.oauth-client:google-oauth-client CVEs against the assets you own.

Start Free Scan →