What’s Vulnerable › Vulnerabilities
CVE-2023-28131
- Severity: critical (CVSS 9.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 23.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2023-04-24 · updated 2026-06-17
- Weakness: CWE-522
Description
A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc).
Affected products
- Expo.io Expo AuthSession module: from 45.0.0 before 48.0.0 — fixed in 48.0.0
How to fix
Upgrade to a fixed version: Expo.io Expo AuthSession module 48.0.0. Check the vendor advisory for mitigations.
References
- https://blog.expo.dev/security-advisory-for-developers-using-authsessions-useproxy-options-and-auth-expo-io-e470fe9346df
- https://www.darkreading.com/endpoint/oauth-flaw-in-expo-platform-affects-hundreds-of-third-party-sites-apps
- https://blog.expo.dev/security-advisory-for-developers-using-authsessions-useproxy-options-and-auth-expo-io-e470fe9346df
- https://www.darkreading.com/endpoint/oauth-flaw-in-expo-platform-affects-hundreds-of-third-party-sites-apps
Get alerted when CVE-2023-28131 or the next vulnerability affects your stack