# CVE-2026-41213

> Vulnerability · severity: **MEDIUM** (CVSS 5.9).

## Description

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.

## Key facts

- **CVE ID:** CVE-2026-41213
- **Published:** 2026-04-23
- **CVSS severity:** MEDIUM
- **CVSS base score:** 5.9
- **CWE codes:** CWE-307, CWE-1289

## Primary sources

- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41213

## Citation

> AI Analytics. CVE-2026-41213. Retrieved 2026-09-26 from https://api.ai-analytics.org/cve/CVE-2026-41213. Derived from NIST NVD. Licensed CC0.

---

*[Dataset catalog](https://api.ai-analytics.org/datasets/) · [AI Analytics](https://api.ai-analytics.org/) · CC0 1.0*