PKCE Downgrade Attack

An authorization server that supports PKCE but does not make its use mandatory for all flows can be susceptible to a PKCE downgrade attack.

OAuth 2.0 Security Best Current Practice (SecBCP, section 4.8)


This threat is considered fully mitigated if all the test cases from the following test set succeed.

Back to the threat overview