Expo SDK has an OAuth vulnerability

Also known as GHSA-wr5g-q49g-548w

Published 3 y ago 2023-04-24 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.6

v3.1 · CNA

CISA KEV

not known exploited

EPSS

23.2%

percentile 98%

Public exploits

none known

A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc).

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 21 mo ago 2025-02-04

Exploit prediction (EPSS)

23.16% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	9.6	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`
NVD	3.1	9.6	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`
CNA	3.1	9.6	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`
GitHub	3.1	9.6	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
npm	`expo`	<48.0.0	48.0.0

Affected products

Expo.io Expo AuthSession module

Classification

Weakness

CWE-522 Insufficiently Protected Credentials

References

blog.expo.dev /security-advisory-for-developers-using-authsessions-useproxy-options-and-auth-expo-io-e47 · x_transferred
darkreading.com /endpoint/oauth-flaw-in-expo-platform-affects-hundreds-of-third-party-sites-apps · x_transferred
nvd.nist.gov /vuln/detail/CVE-2023-28131 · advisory
github.com /expo/expo · package

Sources

CVE List: CVE-2023-28131
GitHub Advisory: GHSA-wr5g-q49g-548w
NVD: CVE-2023-28131

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary