{"id":"CVE-2019-19723","aliases":["GHSA-v6c5-hwqg-3x5q"],"status":"published","title":"Improper Authorization in passport-cognito","description":"All versions of `passport-cognito` are vulnerable to Improper Authorization. The package fails to properly scope the variables containing authorization information, such as access token, refresh token and ID token. This causes a race condition where simultaneous authenticated users may receive authorization tokens for a different user. This would allow a user to take actions on another user's behalf.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2020-09-04T17:23:03Z","modified":"2023-11-08T04:01:29Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"passport-cognito","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"passport-cognito","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0"}]}]}],"references":[{"url":"https://www.npmjs.com/advisories/1443","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19723","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v6c5-hwqg-3x5q"}],"sources":{"ghsa":[{"id":"GHSA-v6c5-hwqg-3x5q","title":"Improper Authorization in passport-cognito","description":"All versions of `passport-cognito` are vulnerable to Improper Authorization. The package fails to properly scope the variables containing authorization information, such as access token, refresh token and ID token. This causes a race condition where simultaneous authenticated users may receive authorization tokens for a different user. This would allow a user to take actions on another user's behalf.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.","status":"published","published":"2020-09-04T17:23:03Z","modified":"2023-01-09T05:04:25Z","cwes":["CWE-285"],"updated_at":"2026-11-02T14:36:09.554044Z"}],"osv":[{"id":"GHSA-v6c5-hwqg-3x5q","title":"Improper Authorization in passport-cognito","description":"All versions of `passport-cognito` are vulnerable to Improper Authorization. The package fails to properly scope the variables containing authorization information, such as access token, refresh token and ID token. This causes a race condition where simultaneous authenticated users may receive authorization tokens for a different user. This would allow a user to take actions on another user's behalf.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.","status":"published","published":"2020-09-04T17:23:03Z","modified":"2023-11-08T04:01:29.223791Z","cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:56.981655Z"}]}}