VDB

CVE-2020-7692

CVE-2020-7692 PUBLISHED

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.

EPSS 0.09% · 25.8th percentile

Risk Scores

EPSS Score
0.09%
25.8th percentile

Affected Products

VendorProductVersions
Ubuntu:22.04:LTSgoogle-oauth-client-java0, 1.28.0-2
Ubuntu:24.04:LTSgoogle-oauth-client-java0, 1.34.1-2
Ubuntu:25.10google-oauth-client-java0, 1.34.1-2

Exploit Intelligence

Timeline

  • Jul 9, 2020 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Jul 21, 2021 CVE Updated
  • Aug 24, 2021 EPSS Score
  • Dec 27, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Feb 28, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 1, 2022 EPSS Score
  • Sep 4, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›