CVE-2021-22573
Last modified
CVE-2021-22573 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Oauth Client Library For Java | < 1.33.3 |
References
- https://github.com/googleapis/google-oauth-java-client/pull/872Issue Tracking, Patch, Release Notes, Third Party Advisory
- https://github.com/googleapis/google-oauth-java-client/pull/872Issue Tracking, Patch, Release Notes, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-22573?
How severe is CVE-2021-22573?
How do I fix CVE-2021-22573?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-22568When using the dart pub publish command to publish a package…8.8
- CVE-2021-22569An issue in protobuf-java allowed the interleaving of com.go…5.5
- CVE-2021-2257Vulnerability in the Oracle Storage Cloud Software Appliance…4.1
- CVE-2021-22570Nullptr dereference when a null char is present in a proto s…5.5
- CVE-2021-22571A local attacker could read files from some other users' SA3…5.5
- CVE-2021-22572On unix-like systems, the system temporary directory is shar…5.5
- CVE-2021-2258Vulnerability in the Oracle Projects product of Oracle E-Bus…8.1
- CVE-2021-2259Vulnerability in the Oracle Payables product of Oracle E-Bus…8.1
- CVE-2021-2260Vulnerability in the Oracle Human Resources product of Oracl…8.1
- CVE-2021-22600A double free bug in packet_set_ring() in net/packet/af_pack…7
- CVE-2021-2261Vulnerability in the Oracle Lease and Finance Management pro…8.1
- CVE-2021-2262Vulnerability in the Oracle Purchasing product of Oracle E-B…8.1
Are you affected by CVE-2021-22573?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST