CVE-2026-49265

Medium

Published: —Translated: 29/09/2026(UTC)NVD NIST

Summary

A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation of the Authorization Code Grant flow. The `code_challenge_method_plain` function uses Python's standard `==` operator for string comparison instead of a constant-time comparison function, potentially allowing attackers to guess values.

Risk Assessment

An attacker performing a timing side-channel attack could potentially recover sensitive data such as the code verifier, leading to session hijacking or unauthorized access.

Recommendation

Replace string comparisons with a constant-time comparison function (e.g., `hmac.compare_digest`) in `code_challenge_method_plain` and other places where sensitive data is compared.

Other vulnerabilities in oauthlib

CVE-2026-49264Medium
When `enable_jsonp=True`, oauthlib's `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation.

Original NVD description (English source)

## Summary A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation of the Authorization Code Grant flow. The `code_challenge_method_plain` function uses Python's standard `==` operator for string comparison instead of a constant-time comparison function, potentially allo

Vulnerability data from NVD (NIST) · CISA KEV · EPSS