MEDIUM 6.8 GitHub
CVE-2026-49265
Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)
## Summary
A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation
of the Authorization Code Grant flow. The `code_challenge_method_plain` function
uses Python's standard `==` operator for string comparison instead of a
constant-time comparison function, potentially allowing timing-based attacks.
## Affected Component
- File: `oauthlib/oauth2/rfc6749/grant_types/authorization_code.py`
- Functions: `code_challenge_method_plain`, `code_challenge_method_s256`
- Vulner
Affected Products
- pip/oauthlib >= 3.0.0, < 4.0.0
References
- https://github.com/advisories/GHSA-xpv3-w29h-x7cv
- https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv
- https://github.com/oauthlib/oauthlib/pull/963
- https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950
This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-09-29 via GitHub. Affected: pip/oauthlib >= 3.0.0, < 4.0.0.
vulnfeed aggregates 10239 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.