CVE-2026-3456-OAuth2-PKCE-Race-Condition-Account-Takeover-

8. CVE-2026-3456 – OAuth2 PKCE Race Condition Account Takeover Overview A race condition in the OAuth2 authorization server allows an attacker to reuse a victim’s authorization code before the legitimate client redeems it, by guessing or brute‑forcing the PKCE codeverifier within a small time...

AZL-108045 CVE-2026-49265 affecting package python-oauthlib 3.2.2-3

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

DEBIAN-CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2026-49265 OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2026-49265

The OAuthLib library (versions 3.0.0 through 4.0.0 ) is vulnerable to a timing side-channel attack during PKCE validation. The issue exists in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py because the code_challenge_method_plain and code_challenge_method_s256 functions use ordinary st...

CVE-2026-49265 OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

EUVD-2026-98833

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2026-105119

OpenAM versions prior to 16.1.3 are vulnerable to a PKCE enforcement bypass via OAuth 2.0 hybrid flows . The root cause is that the software only applies Proof Key for Code Exchange (PKCE) enforcement to authorization requests where the response_type is exactly code. Consequently, codes issued th...

GHSA-XPV3-W29H-X7CV Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

Linux Distros Unpatched Vulnerability : CVE-2026-48717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the...

CVE-2026-48717

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

EUVD-2026-78369

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

CVE-2026-48717

OpenAM Community Edition (through 16.0.6) contains an Improper Authorization flaw (CWE-285) in its OAuth2 authorization-code grant flow. The token endpoint only validates code_verifier when the realm-wide codeVerifierEnforced setting is enabled—a setting that ships disabled by default . When an a...

CVE-2026-48717 OpenAM OAuth Authorization Bypass via PKCE Challenge

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

CVE-2026-48717 OpenAM OAuth Authorization Bypass via PKCE Challenge

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

CVE-2026-48717 OpenAM OAuth Authorization Bypass via PKCE Challenge

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

CVE-2026-48717: Improper Authorization

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

CVE-2026-73309: Incorrect Comparison

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for clientsecret and codeverifier parameters. Attackers can exploit PHP truthy evaluation logic, which...

CVE-2026-47775

Envoy OAuth2 filter vulnerability (CVE-2026-47775): prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the encrypt()/decrypt() path uses AES-256-CBC without an authentication tag (no HMAC/AEAD), enabling a padding oracle via the /callback endpoint. An attacker with the encrypted CodeVerifier ...