Ooauthlib

Products

Exploited and recent CVEs

• CVE-2026-49272 High 8.5 OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow 0.3%
• CVE-2026-118669 High 8.4 OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client 0.3%
• CVE-2026-49264 Medium 6.1 OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation 0.2%
• CVE-2026-49265 Medium 6.8 OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison 0.2%
• CVE-2022-36087 Medium 5.7 OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI 1.8%