fof/oauth

It includes tests, a substantial README, and release notes documenting security fixes. MIT licensing and organization backing support adoption; the prerelease tag and unpinned workflow actions warrant routine caution.

Latest 2.0.0-rc.1

Packagist

86%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Repo tooling

Composer build tooling is present, but no security scanning tools were detected; this is a modest transparency gap rather than evidence of abandonment.

Version stability

This release is a prerelease (2.0.0-rc.1), so its API may still change even though the package has an established stable major history.

Workflow audit

All three workflows were analyzed with no audit findings or untrusted checkouts, but all 3 of 3 action references are unpinned, which weakens build reproducibility and action supply-chain hygiene.

Vulnerabilities

Title	Versions	Severity
CVE-2026-92161 fof/oauth is vulnerable to Insufficient Verification of Data Authenticity in versions 0.0.0 - 1.7.4 and 2.0.0-beta.1 - 2.0.0-beta.4.	0.0.0 - 1.7.42.0.0-beta.1 - 2.0.0-beta.4	Critical

Package versions

Maintainers

David Sevilla Martin

IanM

Direct Dependencies

Dependency	Last Release	Score
flarum/core Version ^2.0.0	—	—
league/oauth2-github Version ^3.1.0	—	—
league/oauth2-google Version ^4.0.1	—	—
omines/oauth2-gitlab Version ^3.3.0	—	—
league/oauth2-facebook Version ^2.2.0	—	—