OAuthLib Vulnerability in Python Implementation Affects Multiple Versions

CVE-2026-49265

What is CVE-2026-49265?

OAuthLib, a library used for implementing OAuth request-signing in Python, has a vulnerability where its PKCE (Proof Key for Code Exchange) checks could allow an attacker to exploit timing differences when comparing code_verifier values with stored challenges. This could potentially lead to unauthorized access-token acquisition and account takeover. Specifically, the vulnerability arises from using ordinary string equality checks, which can reveal information through repeated token endpoint measurements, particularly if an attacker manages to intercept a single-use authorization code. Although local exploitation presents challenges due to network noise, this remains a significant concern for defense-in-depth strategies. The issue has been resolved in version 4.0.0.

References