CVE-2026-49264: oauthlib Unsafe JSONP Callback Injection Vulnerability
Summary
CVE-2026-49264: When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP cal... Affects oauthlib versions >= 0.6.1, < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
oauthlib is a popular Python library that provides a generic implementation of the OAuth 1 and OAuth 2 specifications. It is widely used for building OAuth clients and servers, enabling secure authorization flows in web applications. The library supports various features, including token revocation, which is essential for managing user sessions and security. However, a vulnerability exists in the RevocationEndpoint when JSONP is enabled, allowing attackers to inject arbitrary JavaScript into responses.
Vulnerability Detail
The vulnerability arises from the RevocationEndpoint in oauthlib, which reflects user-supplied callback parameters directly into JavaScript response bodies without proper validation. This lack of validation allows attackers to craft malicious callback values, leading to arbitrary JavaScript execution in the context of the client's origin. The issue is particularly dangerous for applications that use JSONP for cross-origin requests, as it can expose sensitive information and allow for unauthorized actions within the user's session.
How To Fix
Minimum fixed version
4.0.0
This is the first release that contains the fix.
pip install --upgrade "oauthlib==4.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating is not immediately possible, consider disabling the JSONP feature by setting 'enable_jsonp=False' in the RevocationEndpoint constructor. This will prevent the vulnerability from being exploited until a proper fix can be applied.
Conclusion
The oauthlib vulnerability CVE-2026-49264 poses a significant risk to applications that enable JSONP on the RevocationEndpoint. It allows attackers to inject arbitrary JavaScript, which can lead to severe security breaches. It is crucial to update to the patched version or disable the JSONP feature to mitigate this risk.
See every vulnerability recorded for oauthlib →
FAQ
JSONP (JSON with Padding) is a technique used to overcome cross-domain restrictions in web browsers by allowing scripts to be loaded from different origins.
An attacker can send a crafted revocation request with a malicious callback value, leading to the execution of arbitrary JavaScript in the context of the client's application.
The vulnerability can lead to unauthorized access to sensitive data, session hijacking, and other malicious actions within the user's browser context.
If your application uses oauthlib versions between 0.6.1 and 3.3.1 with JSONP enabled, it is vulnerable. You can check for vulnerabilities using Vulert without requiring code access.
Vulert is a monitoring tool that alerts users to open-source vulnerabilities in their software by analyzing the Pipfile.lock. It provides real-time alerts and insights into potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for oauthlib.
