Vulnerability in oauthlib (CVE-2026-49265)
Summary
Vulnerability in oauthlib (CVE-2026-49265). Confidential information can be exposed externally. Exploitable via code_challenge_method_plain. Mitigation: upgrade to 4.0.0 or later.
Original description
The description as published by the source.
Summary
A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation
of the Authorization Code Grant flow. The code_challenge_method_plain function
uses Python's standard == operator for string comparison instead of a
constant-time comparison function, potentially allowing timing-based attacks.
Affected Component
- File:
oauthlib/oauth2/rfc6749/grant_types/authorization_code.py - Functions:
code_challenge_method_plain,code_challenge_method_s256 - Vulnerability Type: CWE-208 (Observable Timing Discrepancy)
Technical Details
Python's == operator uses short-circuit evaluation when comparing strings:
- Returns
Falseimmediately if lengths differ - Compares characters left-to-right, stopping at first mismatch
This means comparison time varies linearly with the length of the common prefix
between the attacker-supplied verifier and the stored challenge, creating a
measurable timing oracle.
Proof of Concept
Tested locally against oauthlib source (network jitter eliminated to isolate
pure Python execution time):
| Input | Result | Time (10M iterations) |
|---|---|---|
Wrong first char (B + A*49) |
Fast reject | 0.34106s |
49 chars correct (A*49 + B) |
Deep compare | 0.37847s |
| Difference | 0.03741s |
The ~37ms delta over 10M iterations corresponds to nanosecond-level differences
per call, which are statistically exploitable under controlled conditions.
Attack Scenario
- Attacker intercepts…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-49265 has been found in oauthlib.
Attackers can target a specific entry point like code_challenge_method_plain over the network to misuse the product.
Confidential information can be exposed externally. CVSS score: 6.8/10.
What to do: upgrade oauthlib to 4.0.0 or later.
If unsure, ask your IT team or search "oauthlib CVE-2026-49265" on the vendor's site.
CVE-2026-49265 (oauthlib) — CWE-208 / CVSS v3 6.8
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: code_challenge_method_plain / code_challenge_method_s256 / False / authorization_code
Patched: 4.0.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-208) exists in oauthlib. Attackers reach the vulnerable code path via code_challenge_method_plain without authentication.
Check the vendor advisory for the affected versions of oauthlib. Attack surface: code_challenge_method_plain / code_challenge_method_s256 / False / authorization_code.
Severity: Medium (CVSS 6.8/10). Confidential information can be exposed externally.
Update to 4.0.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'oauthlib' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'oauthlib' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
oauthlibを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade oauthlib to 4.0.0ステージング環境で 4.0.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。