CVE-2026-49264 OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
Attacker-controlled JavaScript execution via unsafe JSONP callback injection in OAuthLib's RevocationEndpoint when JSONP is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-49264?
CVE-2026-49264 is a medium-severity cross-site scripting vulnerability in oauthlib, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application's origin, with access to its DOM and script-accessible data. The feature is disabled by default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version 4.0.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-49264?
3 open source packages ship an affected version, including oauthlib.
| Package | Affected | Fixed in |
|---|---|---|
oauthlib PyPI | From 0.6.1 | 4.0.0 |
oauthlib PyPI | From 0.6.1 | 4.0.0 |
oauthlib PyPI | From 0.6.1 | 4.0.0 |
Linux distribution packages (3)
python-oauthlib SUSE:Linux Enterprise Micro 5.5 | All versions | 2.0.6-150000.3.9.1 |
python-oauthlib SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.0.6-150000.3.9.1 |
python-oauthlib openSUSE:Tumbleweed | All versions | 4.0.0-1.1 |
How do I fix CVE-2026-49264?
Upgrade oauthlib to 4.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-49264 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49264 exists.
Sources
Also known as AZL-108042, CLEANSTART-2026-JM52525, CLEANSTART-2026-PM64719, CLEANSTART-2026-UF47691, DEBIAN-CVE-2026-49264, ECHO-5e10-b8eb-8481 and 33 more.