CVE-2026-49265

6.8Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.8Medium

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required
Impact: High impact on confidentiality, integrity
Weakness: CWE-208

Impact

Remote attackers can potentially recover PKCE code_verifier values to acquire unauthorized access tokens and take over accounts. Exploitation requires intercepting a single-use authorization code and measuring token endpoint timing differences through network noise.

Root cause

PKCE validation compares attacker-supplied code_verifier values to stored challenges using non-constant-time string equality, leaking common-prefix timing information.

Affected systems

OAuthLib 3.0.0 through versions prior to 4.0.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade OAuthLib to version 4.0.0 or later; no interim configuration workaround is provided.

shell

$ pip install --upgrade 'oauthlib>=4.0.0'

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in code_challenge_method_plain and code_challenge_method_s256. Because the comparison can return after a length difference or the first mismatching character, repeated token endpoint measurements can reveal common-prefix timing information that could potentially allow recovery of the code_verifier, unauthorized access-token acquisition, and account takeover. Practical exploitation requires an intercepted, single-use authorization code and enough measurements to overcome real-world network noise; the local timing benchmark does not establish practical remote account takeover, so the weakness remains a defense-in-depth concern. This issue is fixed in version 4.0.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-49265