CVE-2026-49265: Oauthlib Timing Attack Vulnerability in PKCE Code Verifier Comparison
Summary
CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208). Affects oauthlib versions >= 3.0.0, < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Oauthlib is a popular Python library that provides a framework for implementing OAuth 1 and OAuth 2 protocols. It is widely used for securing APIs and enabling third-party applications to access user data without exposing credentials. The library supports various OAuth flows, including the Authorization Code Grant flow, which is essential for secure authentication. However, a timing attack vulnerability has been identified in its PKCE implementation, which could potentially allow attackers to exploit timing discrepancies during code verifier comparisons.
Vulnerability Detail
A timing side-channel vulnerability exists in the PKCE implementation of the Authorization Code Grant flow in Oauthlib. The vulnerability arises from the use of Python's standard '==' operator for string comparison in the 'code_challenge_method_plain' function. This method does not utilize a constant-time comparison function, leading to observable timing discrepancies that attackers can exploit. By measuring response times during repeated requests, an attacker could recover the 'code_verifier' character by character, ultimately leading to account takeover through unauthorized access tokens.
How To Fix
Latest published version: 4.0.0 as of 23 Oct 2026
pip install --upgrade "oauthlib==4.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing rate limiting on the '/token' endpoint to mitigate the risk of timing attacks. Additionally, ensure that authorization codes are single-use and have a short expiration time to limit the window of opportunity for attackers.
Conclusion
The timing attack vulnerability in Oauthlib's PKCE implementation poses a significant risk to applications using this library for OAuth authentication. It is crucial to update to the patched version 4.0.0 or later and implement best practices for secure string comparison to protect against potential exploits.
See every vulnerability recorded for oauthlib →
FAQ
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability could allow attackers to gain unauthorized access to user accounts by recovering the 'code_verifier' used in the PKCE flow.
Yes, implementing rate limiting on the '/token' endpoint and ensuring single-use authorization codes can help mitigate the risk until the package is updated.
PKCE (Proof Key for Code Exchange) is an extension to the OAuth 2.0 protocol that enhances security for public clients by preventing authorization code interception attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for oauthlib.
