Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

GHSA-HJ66-6F7G-4R5V Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

CVE-2026-49264

creationtimestamp| type| source ---|---|--- 2026-09-28 09:10:50+00:00| published-proof-of-concept| https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v...

EUVD-2022-0170

Malicious code in bioql PyPI...

The vulnerability relates to the implementation of OAuth request signature logic in Python’s OAuthLib. It stems from insufficient validation of input data, allowing attackers to trigger a service denial.

The vulnerability relates to the implementation of OAuth request signature logic in Python’s OAuthLib. It stems from insufficient validation of input data in the urivalidate functions. Exploiting this vulnerability could allow an attacker to trigger a service denial...

ROS-20250731-01

Vulnerability in the implementation of OAuth request signing logic for Python OAuthLib is due to insufficient user data validation in urivalidate functions. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

NewStart CGSL MAIN 7.02 : python-oauthlib Vulnerability (NS-SA-2025-0151)

The remote NewStart CGSL host, running version MAIN 7.02, has python-oauthlib packages installed that are affected by a vulnerability: - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redire...

TencentOS Server 4: python-oauthlib (TSSA-2024:0360)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0360 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

OPENSUSE-SU-2025:15100-1 python311-oauthlib-3.2.2-5.4 on GA media

These are all security issues fixed in the python311-oauthlib-3.2.2-5.4 package on the GA media of openSUSE Tumbleweed...

Alibaba Cloud Linux 3 : 0155: fence-agents (ALINUX3-SA-2023:0155)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0155 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-36087: OAuthLib is an implementation of th...

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.

Summary Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak. Red Hat is used by IBM Robotic Process Automation for Cloud Pak as part of base container images. CVE-2016-4074. getaddrinfo is used by IBM Robotic Process Automation for Cloud Pak as part of the ba...

Fedora 37 : python-oauthlib (2022-5a74a5eea7)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-5a74a5eea7 advisory. - Update spec file and sources for 3.2.1 - Fixes CVE-2022-36087 Tenable has extracted the preceding description block directly from the Fedora security...

OPENSUSE-SU-2024:12339-1 python310-oauthlib-3.2.1-1.1 on GA media

These are all security issues fixed in the python310-oauthlib-3.2.1-1.1 package on the GA media of openSUSE Tumbleweed...

CentOS 9 : python-oauthlib-3.1.1-5.el9

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- oauthlib-3.1.1-5.el9 build changelog. - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker...

Fedora 39 : python-oauthlib (2023-da094276a2)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-da094276a2 advisory. Security fix for CVE-2022-36087 https://github.com/advisories/GHSA-3pgj-pg6c-r5p7 Tenable has extracted the preceding description block directly from the...

Fedora: Security Advisory for python-oauthlib (FEDORA-2023-5ab7049a59)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: python-oauthlib-3.2.2-1.fc38

OAuthLib is a generic utility which implements the logic of OAuth without assuming a specific HTTP request object or web framework. Use it to graft OAuth client support onto your favorite HTTP library, or provider support onto your favourite web framework. If you're a maintainer of such a library...

[SECURITY] Fedora 37 Update: python-oauthlib-3.2.2-1.fc37

OAuthLib is a generic utility which implements the logic of OAuth without assuming a specific HTTP request object or web framework. Use it to graft OAuth client support onto your favorite HTTP library, or provider support onto your favourite web framework. If you're a maintainer of such a library...

[SECURITY] Fedora 39 Update: python-oauthlib-3.2.2-1.fc39

OAuthLib is a generic utility which implements the logic of OAuth without assuming a specific HTTP request object or web framework. Use it to graft OAuth client support onto your favorite HTTP library, or provider support onto your favourite web framework. If you're a maintainer of such a library...