CVE-2021-41580 json
Improper Access Control in passport-oauth2
published 2021-09-27 5 y ago modified 2026-06-17 4 mo ago also GHSA-f794-r6xc-hf3v , EUVD-2021-2050
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 70%
- public exploits
- 0
- none known
Summary
The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability
Patch / fix
- npm passport-oauth2 1.6.1
- passportjs passport-oauth2 1.6.1
Exploit prediction
1.30% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | passport-oauth2 | <1.6.1 |
1.6.1 |
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/jaredhanson/passport-oauth2/pull/144
web, patch, third-party-advisory
-
github.com
/jaredhanson/passport-oauth2/commit/8e3bcdff145a2219033bd782fc517229fe3e05ea
web, patch, third-party-advisory
-
github.com
/jaredhanson/passport-oauth2/compare/v1.6.0...v1.6.1
web, patch, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-41580
advisory
-
github.com
/jaredhanson/passport-oauth2
package
-
medium.com
/passportjs/no-access-token-no-service-7fb017c9e262
web
Sources
- CVE List CVE-2021-41580
- GitHub Advisory GHSA-f794-r6xc-hf3v
- NVD CVE-2021-41580
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.