SB20260928141 - Multiple vulnerabilities in oauthlib

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2026-49264)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript in a client application's origin.

The vulnerability exists due to improper neutralization of input during web page generation in the RevocationEndpoint when processing JSONP revocation requests with attacker-controlled callback parameters. A remote attacker can supply a crafted callback parameter to execute arbitrary JavaScript in a client application's origin.

The JSONP feature is disabled by default and exploitation requires a browser page to load the response as JSONP.

2) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-49265)

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to obtain an access token and take over an account.

The vulnerability exists due to an observable timing discrepancy in the PKCE code verifier comparison functions when processing token endpoint requests. A remote attacker can send repeated requests and measure response times to obtain an access token and take over an account.

User interaction is required.

Remediation

Install update from vendor's website.

References

• https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v
• https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv