CVE-2026-49264: oauthlib - Unsafe JSONP Callback Injection in RevocationEndpoint
Summary
CVE-2026-49264: When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP cal... Affects oauthlib versions >= 0.6.1, < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Oauthlib is a popular Python library that implements the OAuth 1 and OAuth 2 specifications, enabling secure authorization for web applications. It provides various endpoints for token management, including the RevocationEndpoint, which allows clients to revoke access tokens. However, a significant vulnerability exists in the RevocationEndpoint when the JSONP feature is enabled, exposing applications to potential JavaScript injection attacks.
Vulnerability Detail
The vulnerability arises when the RevocationEndpoint is configured with 'enable_jsonp=True'. In this scenario, the library reflects the user-supplied 'callback' parameter directly into JavaScript response bodies without validating its legitimacy as a JSONP callback name. This lack of validation allows attackers to inject arbitrary JavaScript code into the response, which can be executed in the context of the client application. The potential ramifications include unauthorized access to sensitive data, manipulation of the client application's DOM, and execution of malicious scripts, especially in environments where the client application trusts the response from the authorization server.
How To Fix
Latest published version: 4.0.0 as of 23 Oct 2026
pip install --upgrade "oauthlib==4.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider disabling the JSONP feature by setting 'enable_jsonp=False' in the RevocationEndpoint constructor. This will prevent the vulnerability from being exploited until a proper fix can be applied.
Conclusion
The vulnerability CVE-2026-49264 in oauthlib's RevocationEndpoint poses a significant risk due to unsafe JSONP callback injection. It is crucial to update to the patched version or disable the JSONP feature to mitigate potential attacks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for oauthlib →
FAQ
JSONP (JSON with Padding) is a technique used to overcome cross-origin restrictions in web browsers by allowing scripts to be loaded from different domains.
If your application uses oauthlib's RevocationEndpoint with JSONP enabled, an attacker could inject malicious JavaScript that executes in the context of your application, potentially compromising sensitive data.
As a temporary measure, disable the JSONP feature by setting 'enable_jsonp=False' in your RevocationEndpoint configuration.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities in your application without requiring any installation.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for oauthlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
