{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "3.0.0"
                  },
                  {
                    "fixed": "4.0.0"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StringRangeExpression"
              },
              {
                "range": [
                  {
                    "fixed": "74664d3fe037a354e180e305135c6bab1747a6b0"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              },
              {
                "original_tag": "v4.0.0",
                "range": [
                  {
                    "fixed": "145a9a4690cb4d9de30d15fcc2984e34c49df741"
                  }
                ],
                "source": "REFERENCES_TAG"
              }
            ]
          },
          "events": [
            {
              "introduced": "9dfa40c3bdab3aa788e711283afdf36c2fbdd1de"
            },
            {
              "fixed": "145a9a4690cb4d9de30d15fcc2984e34c49df741"
            },
            {
              "fixed": "74664d3fe037a354e180e305135c6bab1747a6b0"
            }
          ],
          "repo": "https://github.com/oauthlib/oauthlib",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-xpv3-w29h-x7cv"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-208"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49265.json"
  },
  "details": "OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in code_challenge_method_plain and code_challenge_method_s256. Because the comparison can return after a length difference or the first mismatching character, repeated token endpoint measurements can reveal common-prefix timing information that could potentially allow recovery of the code_verifier, unauthorized access-token acquisition, and account takeover. Practical exploitation requires an intercepted, single-use authorization code and enough measurements to overcome real-world network noise; the local timing benchmark does not establish practical remote account takeover, so the weakness remains a defense-in-depth concern. This issue is fixed in version 4.0.0.",
  "id": "CVE-2026-49265",
  "modified": "2026-10-28T02:30:27.851305240Z",
  "published": "2026-10-13T15:47:11.854Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49265.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4114.yaml"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49265"
    },
    {
      "type": "FIX",
      "url": "https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0"
    },
    {
      "type": "FIX",
      "url": "https://github.com/oauthlib/oauthlib/pull/963"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison"
}