BCP_4_8

PKCE Downgrade Attack

An authorization server that supports PKCE but does not make its use mandatory for all flows can be susceptible to a PKCE downgrade attack.

OAuth 2.0 Security Best Current Practice (draft 25) (SecBCP, section 4.8)

Mitigations

This threat is considered fully mitigated if all the test cases from the following test set succeed.

• Set #1
• Pkce.IsPkceDowngradeDetectedTest
• Pkce.IsPkcePlainDowngradeDetectedTest
• Pkce.IsPkceTokenDowngradeDetectedTest

Back to the threat overview