The node-oauth2-server module improperly restricts excessive authentication attempts in its implementation of the PKCE S256 flow. Specifically, it accepts RFC7636-invalid code_verifier values, such as one-character strings, and does not consume the authorization code on failed verifier attempts. This flaw allows an attacker who intercepts an authorization code to repeatedly guess the code_verifier value online until a valid token is issued, bypassing intended security controls on the OAuth2 token exchange process.

An attacker who intercepts an OAuth2 authorization code can brute-force the code_verifier parameter due to weak validation and lack of consumption of the authorization code on failed attempts. Successful exploitation results in unauthorized token issuance, leading to potential account compromise or unauthorized access. The vulnerability does not affect integrity or availability but has a high confidentiality impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available and the vulnerability affects versions prior to 5.3.0, users should monitor the vendor's announcements for updates. In the meantime, consider implementing additional rate limiting or monitoring on token exchange endpoints to detect and prevent brute-force attempts.