CVE-2023-28131: Expo Package OAuth Vulnerability Leading to Account Takeover
Summary
CVE-2023-28131: Expo SDK has an OAuth vulnerability. Affects expo versions < 48.0.0. Fixed in 48.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Expo is an open-source framework and platform for universal React applications. It provides a set of tools and services that streamline the development process, allowing developers to build applications for iOS, Android, and the web using a single codebase. The framework includes features such as easy integration with native APIs, over-the-air updates, and a rich ecosystem of libraries. However, a critical vulnerability has been identified in the Expo SDK related to its OAuth implementation, specifically in the 'Expo AuthSession Redirect Proxy' used for social sign-in.
Vulnerability Detail
The vulnerability allows an attacker to take over user accounts and steal credentials from applications or websites that have configured the 'Expo AuthSession Redirect Proxy' for social sign-in. This can occur when a victim clicks on a malicious link, which could be distributed through various channels such as email, text messages, or an attacker-controlled website. The potential ramifications include unauthorized access to user accounts, data breaches, and loss of sensitive information.
How To Fix
Latest published version: 58.0.17 as of 23 Oct 2026
npm install expo@58.0.17Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
48.0.0
This is the first release that contains the fix.
npm install expo@48.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the 'Expo AuthSession Redirect Proxy' feature until you can update to the patched version. This may involve modifying your authentication flow to avoid using this proxy.
Conclusion
The CVE-2023-28131 vulnerability in the Expo SDK poses a significant risk to applications using the OAuth feature for social sign-in. It is crucial for developers to update to version 48.0.0 or later to mitigate this risk and protect user accounts from potential takeover.
See every vulnerability recorded for expo →
FAQ
CVE-2023-28131 is a critical vulnerability in the Expo SDK that allows attackers to take over user accounts through a flaw in the OAuth implementation.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The consequences include potential unauthorized access to user accounts, data breaches, and the theft of sensitive user information.
You can update the Expo package by running the command 'npm install expo@48.0.0' in your project directory.
Yes, you can temporarily disable the 'Expo AuthSession Redirect Proxy' feature in your application until you can update to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for expo.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
