python313-oauthlib-4.0.0-1.1 on GA media (moderate)

python313-oauthlib-4.0.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11973-1 Rating: moderate Cross-References: CVE-2026-49264 CVSS scores: CVE-2026-49264 SUSE : 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2026-49264 SUSE : 2.3...

PT-2026-105682

These are all security issues fixed in the python313-oauthlib-4.0.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11973-1 python313-oauthlib-4.0.0-1.1 on GA media

These are all security issues fixed in the python313-oauthlib-4.0.0-1.1 package on the GA media of openSUSE Tumbleweed...

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

SummaryA timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

PYSEC-2026-4114 Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

SummaryWhen enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instea...

a2 (>=0.1.0, <=0.7.0), a2grunnerp (>=0.1.0, <=0.1.8) +1535 more potentially affected by CVE-2026-49264 via oauthlib (>=0.6.3, <=3.3.1)

oauthlib PYPI version =0.6.3, =0.1.0, =0.1.0, =1.0.32, =0.1.0, =3.2.1, =0.2.0, =3.2.0, =1.1.0, =0.1.31, =1.0.0, =0.0.8, =0.0.1, =1.1.73b0, =0.1.0, =2.2.0 and more Source cves: CVE-2026-49264 Source advisory: OSV:PYSEC-2026-4113...

PYSEC-2026-4113 Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

PT-2026-105862

Summary When enable jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation...

PT-2026-105863

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The code challenge method plain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

a2 (>=0.1.0, <=0.7.0), a2grunnerp (>=0.1.0, <=0.1.8) +1535 more potentially affected by CVE-2026-49264 via oauthlib (>=0.6.3, <=3.3.1)

oauthlib PYPI version =0.6.3, =0.1.0, =0.1.0, =1.0.32, =0.1.0, =3.2.1, =0.2.0, =3.2.0, =1.1.0, =0.1.31, =1.0.0, =0.0.8, =0.0.1, =1.1.73b0, =0.1.0, =2.2.0 and more Source cves: CVE-2026-49264 Source advisory: MEND:CVE-2026-49264...

CVE-2026-49264

When "enablejsonp=True", oauthlib's "RevocationEndpoint" reflects the user-supplied "callback" parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead...

a2 (>=0.1.0, <=0.7.0), a2grunnerp (>=0.1.0, <=0.1.8) +1430 more potentially affected by CVE-2026-49265 via oauthlib (>=3.0.0, <=3.3.1)

oauthlib PYPI version =3.0.0, =0.1.0, =0.1.0, =1.0.32, =0.1.0, =3.2.1, =0.2.0, =3.2.0, =1.1.0, =0.1.31, =1.0.0, =0.0.8, =0.0.1, =1.1.73b0, =0.1.0, =2.2.0 and more Source cves: CVE-2026-49265 Source advisory: SNYK:PYTHON-OAUTHLIB-20305255...

a2 (>=0.1.0, <=0.7.0), a2grunnerp (>=0.1.0, <=0.1.8) +1430 more potentially affected by CVE-2026-49265 via oauthlib (>=3.0.0, <=3.3.1)

oauthlib PYPI version =3.0.0, =0.1.0, =0.1.0, =1.0.32, =0.1.0, =3.2.1, =0.2.0, =3.2.0, =1.1.0, =0.1.31, =1.0.0, =0.0.8, =0.0.1, =1.1.73b0, =0.1.0, =2.2.0 and more Source cves: CVE-2026-49265 Source advisory: OSV:GHSA-XPV3-W29H-X7CV...

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

a2 (>=0.1.0, <=0.7.0), a2grunnerp (>=0.1.0, <=0.1.8) +1430 more potentially affected by CVE-2026-49265 via oauthlib (>=3.0.0, <=3.3.1)

oauthlib PYPI version =3.0.0, =0.1.0, =0.1.0, =1.0.32, =0.1.0, =3.2.1, =0.2.0, =3.2.0, =1.1.0, =0.1.31, =1.0.0, =0.0.8, =0.0.1, =1.1.73b0, =0.1.0, =2.2.0 and more Source cves: CVE-2026-49265 Source advisory: GHSA-XPV3-W29H-X7CV...

GHSA-XPV3-W29H-X7CV Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the codechallengemethods256 and codechallengemethodplain functions in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py, which compare PKCE code verifiers and challenges using the non-constant-time == operator. A...

a2 (>=0.1.0, <=0.7.0), a2grunnerp (>=0.1.0, <=0.1.8) +1535 more potentially affected by CVE-2026-49264 via oauthlib (>=0.6.3, <=3.3.1)

oauthlib PYPI version =0.6.3, =0.1.0, =0.1.0, =1.0.32, =0.1.0, =3.2.1, =0.2.0, =3.2.0, =1.1.0, =0.1.31, =1.0.0, =0.0.8, =0.0.1, =1.1.73b0, =0.1.0, =2.2.0 and more Source cves: CVE-2026-49264 Source advisory: SNYK:PYTHON-OAUTHLIB-20305256...

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...