CVE-2021-46249: SCRATCHOAUTH2 Project SCRATCHOAUTH2

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their own apps.

Affected products

• SCRATCHOAUTH2 Project SCRATCHOAUTH2: before 2021-04-12 (fixed in 2021-04-12)

Published 2022-02-15. Last modified 2026-06-17.