An AI-assisted PKCE feature checked a verifier only when an authorization grant stored a challenge. A token request could therefore present a verifier for a grant created without a challenge. The published downgrade flow also requires absent or incorrect client state validation; ordinary grant, client, authentication and redirect checks still apply. The repair rejects a verifier when the stored grant has no challenge and is present in the retained npm 0.0.5 package. This closes the scoped consistency defect without claiming universal OAuth protection.

@@ -695,6 +719,38 @@       );     } +    // Verify PKCE code_verifier if code_challenge was provided during authorization+    if (grantData.codeChallenge) {+      if (!codeVerifier) {+        return createErrorResponse(+          'invalid_request',

+          'code_verifier is required for PKCE'+        );+      }+

+      // Verify the code verifier against the stored code challenge+      let calculatedChallenge: string;++      if (grantData.codeChallengeMethod === 'S256') {+        // SHA-256 transformation for S256 method+        const encoder = new TextEncoder();+        const data = encoder.encode(codeVerifier);

+        const hashBuffer = await crypto.subtle.digest('SHA-256', data);+        const hashArray = Array.from(new Uint8Array(hashBuffer));+        calculatedChallenge = base64UrlEncode(String.fromCharCode(...hashArray));+      } else {+        // Plain method, direct comparison

+        calculatedChallenge = codeVerifier;+      }++      if (calculatedChallenge !== grantData.codeChallenge) {+        return createErrorResponse(+          'invalid_grant',+          'Invalid PKCE code_verifier'

+        );+      }+    }+     // Code is valid - generate tokens     const accessTokenSecret = generateRandomString(TOKEN_LENGTH);     const refreshTokenSecret = generateRandomString(TOKEN_LENGTH);

@@ -1235,6 +1235,11 @@       return this.createErrorResponse('invalid_grant', 'Invalid redirect URI');     } +    // Reject if code_verifier is provided but PKCE wasn't used in authorization+    if (!isPkceEnabled && codeVerifier) {+      return this.createErrorResponse('invalid_request', 'code_verifier provided for a flow that did not use PKCE');+    }+

     // Verify PKCE code_verifier if code_challenge was provided during authorization     if (isPkceEnabled) {       if (!codeVerifier) {