Source: python-oauthlib X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerabilities were published for python-oauthlib. CVE-2026-49264[0]: | OAuthLib is an implementation of the OAuth request-signing logic for | Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint | in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an | unvalidated callback request parameter into success and error | response bodies when enable_jsonp=True. The callback can come from | the query string or request body and is used without restricting it | to a legal JavaScript function name. A browser application that | loads the revocation response as trusted JSONP and permits attacker | influence over callback can therefore execute attacker-controlled | JavaScript in the including application's origin, with access to its | DOM and script-accessible data. The feature is disabled by default, | so only deployments that explicitly enable JSONP are affected. This | issue is fixed in version 4.0.0. https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v https://github.com/oauthlib/oauthlib/pull/951 https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c (v4.0.0) CVE-2026-49265[1]: | OAuthLib is an implementation of the OAuth request-signing logic for | Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in | oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare | attacker-supplied code_verifier values with stored challenges using | ordinary string equality in code_challenge_method_plain and | code_challenge_method_s256. Because the comparison can return after | a length difference or the first mismatching character, repeated | token endpoint measurements can reveal common-prefix timing | information that could potentially allow recovery of the | code_verifier, unauthorized access-token acquisition, and account | takeover. Practical exploitation requires an intercepted, single-use | authorization code and enough measurements to overcome real-world | network noise; the local timing benchmark does not establish | practical remote account takeover, so the weakness remains a | defense-in-depth concern. This issue is fixed in version 4.0.0. https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv https://github.com/oauthlib/oauthlib/pull/963 https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0 (v4.0.0) If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-49264 https://www.cve.org/CVERecord?id=CVE-2026-49264 [1] https://security-tracker.debian.org/tracker/CVE-2026-49265 https://www.cve.org/CVERecord?id=CVE-2026-49265 Please adjust the affected versions in the BTS as needed.
