CVE-2021-22573— Incorrect signature verification on Google-oauth-java-client
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-22573
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incorrect signature verification on Google-oauth-java-client
Source: NVD (National Vulnerability Database)
Vulnerability Description
The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
密码学签名的验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Google google-oauth-java-client 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Google google-oauth-java-client（Google OAuth Client Library for Java）是美国谷歌（Google）公司的一款基于Java的Google OAuth（开放授权）客户端库。 Google google-oauth-java-client 存在安全漏洞，该漏洞源于 IDToken 验证器不验证令牌是否正确签名。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Google LLC | Google-oauth-java-client | unspecified ~ 1.33.2 | - |
II. Public POCs for CVE-2021-22573
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-22573
请登录查看更多情报信息。
- https://github.com/googleapis/google-oauth-java-client/pull/872x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2021-22573
Same Patch Batch · Google LLC · 2022-05-03 · 3 CVEs total
| CVE-2021-22556 | 5.3 MEDIUM | Integer Overflow in Fuchsia Kernel |
| CVE-2022-0882 | 5.3 MEDIUM | Illegal access to Kernel log in Fuchsia |
IV. Related Vulnerabilities
Same vendor: Google LLC
- CVE-2022-3095
Incorrect parsing of the backslash characters in Dart librar - CVE-2022-3474
Bazel leaks user credentials through the remote assets API - CVE-2022-3421
Privilege escalation in Google Drive for Desktop on MacOS - CVE-2022-3171
Memory handling vulnerability in ProtocolBuffers Java core a - CVE-2022-1941
Out of Memory issue in ProtocolBuffers for cpp and python
Same weakness: CWE-347
- CVE-2026-44714
bitcoinj: ScriptExecution P2PKH/P2WPKH Verification Bypass - CVE-2026-44309
gitsign verify accepts signatures over go-git-normalized byt - CVE-2024-36334
AMD Radeon显卡驱动存在权限提升漏洞 - CVE-2026-0265
PAN-OS: Authentication Bypass with Cloud Authentication Serv - CVE-2026-41431
Zen Browser MAR updater ships with signature verification re
V. Comments for CVE-2021-22573
No comments yet