CVE-2026-49264

6.1Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.1Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Remote attackers can execute arbitrary JavaScript in a victim's browser session via cross-site scripting. Exploitation requires user interaction with an application that explicitly turns on JSONP on the token revocation endpoint.

Root cause

The RevocationEndpoint reflects the user-supplied callback parameter directly into JSONP responses without validating that it is a legal JavaScript function identifier.

Affected systems

OAuthLib 0.6.1 through 3.2.2 (versions prior to 4.0.0)

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade to OAuthLib 4.0.0 or later. If upgrading is delayed, disable JSONP support by ensuring enable_jsonp remains False (the default) on the RevocationEndpoint.

shell

$ pip install --upgrade 'oauthlib>=4.0.0'

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application's origin, with access to its DOM and script-accessible data. The feature is disabled by default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version 4.0.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-49264