CVE-2026-49265 · GHSA-xpv3-w29h-x7cv

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Risk score: 57/100
CVSS: 6.8 v3.1
Exploit chance (30 days): 0.4%
Published: 29 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in code_challenge_method_pla…
Affected: oauthlib (pip) >= 3.0.0, < 4.0.0
Fix: Upgrade oauthlib to 4.0.0 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

oauthlib: Yellow, plan it in. OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in code_challenge_method_pla…

The flaws

CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208) (CVSS 6.8 · EPSS 0%)
CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation (CVSS 6.1 · EPSS 0%)

The fix

Upgrade oauthlib: 4.0.0 or later on your release line

Who is exposed: oauthlib (pip) >= 3.0.0, < 4.0.0

Where it stands

Public proof of concept

Connects to

Same weakness: CWE-208 (CWE-208). 4 other warnings in 30 days

Why it is Yellow

CVSS 6.8 medium
Public exploit or proof of concept referenced
On your watchlist: PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
oauthlib	pip	>= 3.0.0, < 4.0.0	4.0.0

References

Original description

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in code_challenge_method_plain and code_challenge_method_s256. Because the comparison can return after a length difference or the first mismatching character, repeated token endpoint measurements can reveal common-prefix timing information that could potentially allow recovery of the code_verifier, unauthorized access-token acquisition, and account takeover. Practical exploitation requires an intercepted, single-use authorization code and enough measurements to overcome real-world network noise; the local timing benchmark does not establish practical remote account takeover, so the weakness remains a defense-in-depth concern. This issue is fixed in version 4.0.0.

Last activity 29 Sep 2026. Patch Forecast updates every hour.