a2 (>=0.1.0, <=0.7.0), a2grunnerp (>=0.1.0, <=0.1.8) +1535 more potentially affected by CVE-2026-49264 via oauthlib (>=0.6.3, <=3.3.1)

oauthlib PYPI version =0.6.3, =0.1.0, =0.1.0, =1.0.32, =0.1.0, =3.2.1, =0.2.0, =3.2.0, =1.1.0, =0.1.31, =1.0.0, =0.0.8, =0.0.1, =1.1.73b0, =0.1.0, =2.2.0 and more Source cves: CVE-2026-49264 Source advisory: OSV:GHSA-HJ66-6F7G-4R5V...

a2 (>=0.1.0, <=0.7.0), a2grunnerp (>=0.1.0, <=0.1.8) +1535 more potentially affected by CVE-2026-49264 via oauthlib (>=0.6.3, <=3.3.1)

oauthlib PYPI version =0.6.3, =0.1.0, =0.1.0, =1.0.32, =0.1.0, =3.2.1, =0.2.0, =3.2.0, =1.1.0, =0.1.31, =1.0.0, =0.0.8, =0.0.1, =1.1.73b0, =0.1.0, =2.2.0 and more Source cves: CVE-2026-49264 Source advisory: GHSA-HJ66-6F7G-4R5V...

GHSA-HJ66-6F7G-4R5V Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

PT-2026-102980

Name of the Vulnerable Software and Affected Versions oauthlib versions 0.6.1 through 3.3.1 Description When the enable jsonp parameter is set to True, the RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths. Th...

PT-2026-102981

Name of the Vulnerable Software and Affected Versions oauthlib affected versions not specified Description A timing side-channel exists in the PKCE implementation of the Authorization Code Grant flow. The functions code challenge method plain and code challenge method s256 in the file...

CVE-2026-49265

creationtimestamp| type| source ---|---|--- 2026-09-28 09:17:11+00:00| published-proof-of-concept| https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv 2026-10-13 15:58:19+00:00| seen| https://infosec.exchange/users/cve/statuses/117434423657230808...

CVE-2026-49264

creationtimestamp| type| source ---|---|--- 2026-09-28 09:10:50+00:00| published-proof-of-concept| https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v 2026-10-13 15:57:44+00:00| seen| https://infosec.exchange/users/cve/statuses/117434421011343396...

EUVD-2022-0170

Malicious code in bioql PyPI...

OAuthLib OAuth Signature DoS

The vulnerability relates to the implementation of OAuth request signature logic in Python’s OAuthLib. It stems from insufficient validation of input data in the urivalidate functions. Exploiting this vulnerability could allow an attacker to trigger a service denial...

ROS-20250731-01

Vulnerability in the implementation of OAuth request signing logic for Python OAuthLib is due to insufficient user data validation in urivalidate functions. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

NewStart CGSL MAIN 7.02 : python-oauthlib Vulnerability (NS-SA-2025-0151)

The remote NewStart CGSL host, running version MAIN 7.02, has python-oauthlib packages installed that are affected by a vulnerability: - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redire...

TencentOS Server 4: python-oauthlib (TSSA-2024:0360)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0360 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

OPENSUSE-SU-2025:15100-1 python311-oauthlib-3.2.2-5.4 on GA media

These are all security issues fixed in the python311-oauthlib-3.2.2-5.4 package on the GA media of openSUSE Tumbleweed...

Alibaba Cloud Linux 3 : 0155: fence-agents (ALINUX3-SA-2023:0155)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0155 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-36087: OAuthLib is an implementation of th...

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.

Summary Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak. Red Hat is used by IBM Robotic Process Automation for Cloud Pak as part of base container images. CVE-2016-4074. getaddrinfo is used by IBM Robotic Process Automation for Cloud Pak as part of the ba...

Fedora 37 : python-oauthlib (2022-5a74a5eea7)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-5a74a5eea7 advisory. - Update spec file and sources for 3.2.1 - Fixes CVE-2022-36087 Tenable has extracted the preceding description block directly from the Fedora security...

OPENSUSE-SU-2024:12339-1 python310-oauthlib-3.2.1-1.1 on GA media

These are all security issues fixed in the python310-oauthlib-3.2.1-1.1 package on the GA media of openSUSE Tumbleweed...

CentOS 9 : python-oauthlib-3.1.1-5.el9

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- oauthlib-3.1.1-5.el9 build changelog. - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker...

Fedora 39 : python-oauthlib (2023-da094276a2)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-da094276a2 advisory. Security fix for CVE-2022-36087 https://github.com/advisories/GHSA-3pgj-pg6c-r5p7 Tenable has extracted the preceding description block directly from the...

Fedora: Security Advisory for python-oauthlib (FEDORA-2023-5ab7049a59)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...