Cross-Site Scripting Vulnerability in OAuthLib for Python by OAuth Community
CVE-2026-49264

6.1MEDIUM

Key Information:

Vendor

Oauthlib

Status
Oauthlib
Vendor
CVE Published:
13 October 2026

What is CVE-2026-49264?

OAuthLib, a library widely used for OAuth integration in Python applications, includes a vulnerability in the RevocationEndpoint. In versions 0.6.1 to 4.0.0, the library reflects an unvalidated 'callback' request parameter in the success and error response bodies when 'enable_jsonp' is set to True. This allows a potential attacker to execute arbitrary JavaScript code within applications that trust JSONP responses, granting them access to sensitive data within the application's context. While the JSONP feature is disabled by default, any deployment that enables it is at risk. The issue has been addressed in version 4.0.0.

Affected Version(s)

oauthlib >= 0.6.1, < 4.0.0

References

https://github.com/oauthlib/oauthlib/security/advisories/...
x_refsource_CONFIRM
https://github.com/oauthlib/oauthlib/pull/951
x_refsource_MISC
https://github.com/oauthlib/oauthlib/commit/c888359f3c42b...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.