CVE-2026-49265: Oauthlib Timing Attack Vulnerability in PKCE Code_Verifier Comparison
Summary
CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208). Affects oauthlib versions >= 3.0.0, < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Oauthlib is a popular Python library that provides a framework for OAuth 1 and OAuth 2, enabling developers to integrate secure authorization into their applications. It simplifies the implementation of various OAuth flows, including the Authorization Code Grant flow, which is widely used for web applications. However, a vulnerability has been identified in its PKCE (Proof Key for Code Exchange) implementation, specifically in the way it compares code verifiers, potentially exposing applications to timing attacks.
Vulnerability Detail
A timing side-channel vulnerability exists in the PKCE implementation of the Authorization Code Grant flow in Oauthlib. The affected function, code_challenge_method_plain, uses Python's standard '==' operator for string comparison instead of a constant-time comparison function. This can lead to timing-based attacks where an attacker can measure the time taken for string comparisons to infer information about the code_verifier, potentially allowing them to recover it character by character. This vulnerability is categorized as CWE-208 (Observable Timing Discrepancy) and can lead to account takeover if exploited.
How To Fix
Latest published version: 4.0.0 as of 23 Oct 2026
pip install --upgrade "oauthlib==4.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing a constant-time comparison function in your code as a temporary workaround. Replace the usage of '==' for comparing code verifiers with the following code: 'hmac.compare_digest(code_verifier, stored_challenge)'. This will help mitigate the timing attack risk until the package can be updated.
Conclusion
The Oauthlib timing attack vulnerability (CVE-2026-49265) poses a significant risk to applications using the library for OAuth 2.0 authorization flows. By understanding the nature of the vulnerability and following the recommended steps to update the package or implement workarounds, developers can protect their applications from potential exploitation.
See every vulnerability recorded for oauthlib →
FAQ
The CVSS score of this vulnerability is 6.8, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
PKCE (Proof Key for Code Exchange) is an extension to the OAuth 2.0 protocol that enhances security for public clients by requiring them to generate a code_verifier and code_challenge during the authorization process.
If exploited, this vulnerability can allow an attacker to recover the code_verifier, leading to unauthorized access and account takeover.
Yes, the vulnerability has been fixed in oauthlib version 4.0.0 and later. It is recommended to update to this version.
References
Related vulnerabilities
Recent vulnerabilities recorded for oauthlib.
