{"cve":"CVE-2021-22573","nvd":{"published":"2022-05-03T16:15:18.700","modified":"2026-06-17T03:37:27.323","status":"Modified","description":"The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","score":7.3},"cwes":["CWE-347"],"references":["https://github.com/googleapis/google-oauth-java-client/pull/872","https://github.com/googleapis/google-oauth-java-client/pull/872"],"products":["google:oauth_client_library_for_java"],"source":"nvd","synced_at":"2026-10-19T21:30:03.577988018+00:00"},"epss":{"cve":"CVE-2021-22573","score":0.003,"percentile":0.22807,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hw42-3568-wj87","url":"https://osv.dev/vulnerability/GHSA-hw42-3568-wj87","summary":"google-oauth-java-client improperly verifies cryptographic signature","modified":"2024-04-10T18:58:40.726201Z","packages":[{"ecosystem":"Maven","name":"com.google.oauth-client:google-oauth-client","purl":"pkg:maven/com.google.oauth-client/google-oauth-client","ranges":[">=1.16.0-rc <1.33.3"],"fixed":["1.33.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}