CVE-2021-46249

Published February 15th, 2022

View on NVD ↗

CVSS v3

6.5

MEDIUM

CVSS v2

MEDIUM

Affected

PROJECT

Description

An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their own apps.

ScratchVerifier/ScratchOAuth2

Since Scratch has no native OAuth, "Fine, I'll do it myself."

GitHub