Back to Database
Status published
High
CVE-2021-22573
Incorrect signature verification on Google-oauth-java-client
Vulnerability Description
The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-22573
Credits & Attribution
No credits recorded in the NVD database.
More from Google LLC
View All →CVE-2022-3474
Bazel leaks user credentials through the remote assets API
Medium
5.1
CVE-2022-3421
Privilege escalation in Google Drive for Desktop on MacOS
Medium
5.6
CVE-2022-3171
Memory handling vulnerability in ProtocolBuffers Java core and lite
Medium
4.3
CVE-2022-3095
Incorrect parsing of the backslash characters in Dart library
Critical
9.8
CVE-2022-2390
Mutable pending intent in Google Play services SDK
Medium
6.1
Affected Vendor
Google LLC
View all reports →Affected Software
Google-oauth-java-client
Vulnerable Versions:
unspecified
Timeline
Official Publish:
May 3rd, 2022
Last Modified:
April 21st, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N