CVE-2026-49264

Medium

Published: —Translated: 29/09/2026(UTC)NVD NIST

Summary

When `enable_jsonp=True`, oauthlib's `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation.

Risk Assessment

An attacker can exploit this to inject malicious scripts, potentially leading to XSS attacks or data theft in the context of applications using oauthlib.

Recommendation

Disable JSONP support if not required, and add validation of the `callback` parameter to allow only legal function names (e.g., matching `[A-Za-z0-9_.]+`).

Other vulnerabilities in oauthlib

CVE-2026-49265Medium
A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation of the Authorization Code Grant flow. The `code_challenge_method_plain` function uses Python's standard `==` operator for string comparison instead of a constant-time comparison function, potentially allowing attackers to guess values.

Original NVD description (English source)

### Summary When `enable_jsonp=True`, oauthlib's `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generat

Vulnerability data from NVD (NIST) · CISA KEV · EPSS