CVE-2021-41580

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Sep 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-415815.5x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. When t CVE-2021-415836.5vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated CVE-2021-415847.5Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configura CVE-2021-415857.5Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop CVE-2021-415867.5In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password.CVE-2021-415877.5In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other re CVE-2021-415888.1In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have CVE-2021-415899.8In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code executi CVE-2021-41594.4A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be ret CVE-2021-415905.3In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test. The installati CVE-2021-415919.4ACINQ Eclair before 0.6.3 allows loss of funds because of dust HTLC exposure.CVE-2021-415929.4Blockstream c-lightning through 0.10.1 allows loss of funds because of dust HTLC exposure.