CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
(updated )
When enable_jsonp=True, oauthlib’s RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
References
- github.com/advisories/GHSA-hj66-6f7g-4r5v
- github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c
- github.com/oauthlib/oauthlib/pull/951
- github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v
- github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-49264
Code Behaviors & Features
Detect and mitigate CVE-2026-49264 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →