DEBIAN-CVE-2026-49264

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

AZL-108042 CVE-2026-49264 affecting package python-oauthlib 3.2.2-3

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

AZL-108045 CVE-2026-49265 affecting package python-oauthlib 3.2.2-3

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

DEBIAN-CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2026-49264

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

UBUNTU-CVE-2026-49264

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

UBUNTU-CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2026-49264

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

CVE-2026-49264 OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

CVE-2026-49264

The OAuthLib Python library (versions 0.6.1 through 4.0.0) is vulnerable to an unsafe JSONP callback injection in its RevocationEndpoint (oauthlib/oauth2/rfc6749/endpoints/revocation.py). When JSONP support is enabled (enable_jsonp=True), the application fails to validate user-supplied callback p...

CVE-2026-49264 OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

CVE-2026-49264

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

EUVD-2026-98834

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

CVE-2026-49265 OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2026-49265 OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2026-49265

The OAuthLib library (versions 3.0.0 through 4.0.0 ) is vulnerable to a timing side-channel attack during PKCE validation. The issue exists in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py because the code_challenge_method_plain and code_challenge_method_s256 functions use ordinary st...

CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

EUVD-2026-98833

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...