CVE-2020-7692: Improper Authorization
Vulnerability summary
CVE-2020-7692 is a critical (CVSS 9.1) Incorrect Authorization vulnerability in google oauth_client_library_for_java. EPSS estimates a 1.52% chance of exploitation in the next 30 days, higher than 74.6% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5Timeline
- 09-07-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
CVSS metrics
7 scores · 6 sources · 2 versions- CVE.orgCNA7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · MavenEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
EPSS trend
Probability
1.52%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
Decrease -0.06 pp
From 1.59% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (tools.ietf.org)
Maturity: unknown
Exploit Reference (tools.ietf.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard73 products
- eco-java-gradle-4.10All versions (No fix recorded)
- eco-java-gradle-4.10.1All versions (No fix recorded)
- eco-java-gradle-4.10.2All versions (No fix recorded)
- eco-java-gradle-4.10.3All versions (No fix recorded)
- eco-java-gradle-4.2All versions (No fix recorded)
Com.google.oauth-client1 product
- google-oauth-client< 1.31.0
Debian1 product
- google-oauth-client-java< 1.28.0-2
Google1 product
- oauth_client_library_for_java< 1.31.0
Ubuntu1 product
- google-oauth-client-javaAll versions (No fix recorded)
5 vendors · 77 products
References
14 links- snyk.io/vuln/SNYK-JAVA-COMGOOGLEOAUTHCLIENT-575276X Refsource MISCREPORTAdvisoryWEBThird Party Advisory
- github.com/googleapis/google-oauth-java-client/issues/469X Refsource MISCREPORTAdvisoryWEBThird Party Advisory
- github.com/googleapis/google-oauth-java-client/commit/13433cd7dd06267fc261f0b1d4764f8e3432c824X Refsource MISCREPORTFIXWEBPatchThird Party Advisory
- tools.ietf.org/html/rfc8252%23section-8.1X Refsource MISCREPORTEVIDENCEWEBExploitThird Party Advisory
