CVE-2020-7692
Improper Authorization
CVE-2020-7692 is a high vulnerability (CVSS 7.4) in Google Oauth Client Library For Java, published July 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. Fixed in com.google.oauth-client:google-oauth-client 1.31.0.
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Authorization
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
- Record
CVE-2020-7692- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
EUVDEUVD-2021-2044
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
- Record
EUVD-2021-2044- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f263-c949-w85g
Improper Authorization in Google OAuth Client
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
- Record
GHSA-f263-c949-w85g- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-862, CWE-863
- Updated
- 2026-11-02
NVD
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
- Record
CVE-2020-7692- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
- Record
CVE-2020-7692- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-7692
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
- Record
DEBIAN-CVE-2020-7692- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-f263-c949-w85g
Improper Authorization in Google OAuth Client
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
- Record
GHSA-f263-c949-w85g- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-862, CWE-863
- Updated
- 2026-11-02
OSVRHSA-2023:0560
Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update
- Record
RHSA-2023:0560- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:0777
Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update
- Record
RHSA-2023:0777- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:3299
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2023:3299- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:6172
Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update
- Record
RHSA-2023:6172- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:0778
Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update
- Record
RHSA-2024:0778- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-7692
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
- Record
UBUNTU-CVE-2020-7692- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1774225188 No score
TuxCare security update for com.google.oauth-client:google-oauth-client (1 CVE)
TuxCare rebuilt com.google.oauth-client:google-oauth-client to address 1 CVE. Fixed in 1.25.0-tuxcare.2.
- Record
CLSA-2026-1774225188- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.google.oauth-client:google-oauth-clientMaven |
before 1.31.0 | 1.31.0 |
com.google.oauth-client:google-oauth-clientTuxCare:Maven |
1.25.0 up to 1.25.0-tuxcare.2, plus listed versions 1.25.0-tuxcare.1 |
1.25.0-tuxcare.2 |
google-oauth-client-javaDebian:12 |
before 1.28.0-2 | 1.28.0-2 |
google-oauth-client-javaDebian:13 |
before 1.28.0-2 | 1.28.0-2 |
google-oauth-client-javaDebian:14 |
before 1.28.0-2 | 1.28.0-2 |
com.google.oauth-client:google-oauth-clientMaven |
before 1.31.0, plus listed versions 1.10.0-beta1.10.1-beta1.11.0-beta1.12.0-beta1.13.0-beta Show 33 moreShow less1.13.1-beta1.14.0-beta1.14.1-beta1.15.0-rc1.16.0-rc1.17.0-rc1.18.0-rc1.19.01.20.01.21.01.22.01.23.01.24.11.25.01.26.01.27.01.28.01.29.01.29.21.30.11.30.21.30.31.30.41.30.51.30.61.5.0-alpha1.5.0-beta1.5.1-beta1.5.2-beta1.6.0-beta1.7.0-beta1.8.0-beta1.9.0-beta |
1.31.0 |
jenkins-2-pluginsRed Hat:openshift:4.10::el8 |
before 0:4.10.1675144701-1.el8 | 0:4.10.1675144701-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.9::el8 |
before 0:4.9.1675668922-1.el8 | 0:4.9.1675668922-1.el8 |
jenkinsRed Hat:openshift:4.9::el8 |
before 0:2.361.1.1675668150-1.el8 | 0:2.361.1.1675668150-1.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.13::el8 |
before 0:4.13.1684911916-1.el8 | 0:4.13.1684911916-1.el8 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jenkinsRed Hat:ocp_tools:4.13::el8 |
before 0:2.387.3.1684911776-3.el8 | 0:2.387.3.1684911776-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.12::el8 |
before 0:4.12.1698294000-1.el8 | 0:4.12.1698294000-1.el8 |
jenkinsRed Hat:ocp_tools:4.12::el8 |
before 0:2.414.3.1698293911-3.el8 | 0:2.414.3.1698293911-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.12::el8 |
before 0:4.12.1706515741-1.el8 | 0:4.12.1706515741-1.el8 |
jenkinsRed Hat:ocp_tools:4.12::el8 |
before 0:2.426.3.1706515686-3.el8 | 0:2.426.3.1706515686-3.el8 |
google-oauth-client-javaUbuntu:22.04:LTS |
All versions, plus listed versions 1.28.0-2 |
None known |
google-oauth-client-javaUbuntu:24.04:LTS |
All versions, plus listed versions 1.34.1-2 |
None known |
google-oauth-client-javaUbuntu:25.10 |
All versions, plus listed versions 1.34.1-2 |
None known |
google-oauth-client-javaUbuntu:26.10 |
All versions, plus listed versions 1.34.1-2build1 |
None known |
google-oauth-client-javaUbuntu:26.04:LTS |
All versions, plus listed versions 1.34.1-21.34.1-2build1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, published | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
snyk.io/vuln/SNYK-JAVA-COMGOOGLEOAUTHCLIENT-575276
github.com/googleapis/google-oauth-java-client/issues/469
tools.ietf.org/html/rfc8252%23section-8.1
lists.apache.org/thread.html/r3db6ac73e0558d64f0b664f2fa4ef0a865e57c5de20f8321d3b48678%40%3Ccommits.druid.apache.org%3E
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-7692
security-tracker.debian.org/tracker/CVE-2020-7692
access.redhat.com/errata/RHSA-2023:0560
bugzilla.redhat.com/show_bug.cgi?id=1856376
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0560.json
cve.org/CVERecord?id=CVE-2020-7692
bitbucket.org/snakeyaml/snakeyaml/issues/525
jenkins.io/security/advisory/2022-05-17
mail-archive.com/[email protected]/msg39312.html
docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html
issues.redhat.com/browse/PITEAM-10
tanzu.vmware.com/security/cve-2022-22978
blogs.apache.org/security/entry/cve-2022-42889
seclists.org/oss-sec/2022/q4/22
commons.apache.org/proper/commons-fileupload/security-reports.html
go.dev/issue/63417
pkg.go.dev/vuln/GO-2023-2102
cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
maven.apache.org/docs/3.8.1/release-notes.html
groups.google.com/g/golang-announce/c/nqrv9fbR0zE
spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861
rfc-editor.org/rfc/rfc9110
openwall.com/lists/oss-security/2024/01/24/6
ubuntu.com/security/CVE-2020-7692
Left out here: 130 references. The JSON record has them.