Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

oauthlib

5 known vulnerabilities (2 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
4.0.1 (Oct 31, 2026): no advisory affects it
Newest unaffected release
4.0.1 (Oct 31, 2026), the latest release
Advisories
5 · 2 high, 3 medium
Weekly downloads
64.2M
Dependents
13.6K
Releases
54 since 0.0.1 (Apr 11, 2012)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

    Affected: from 3.3.0, fixed in 4.0.0.

    Fixed in 4.0.0 (released Sep 28, 2026, 38 days before disclosure).

    The latest release, 4.0.1, is not affected.

  • OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

    Affected: fixed in 4.0.0.

    Fixed in 4.0.0 (released Sep 28, 2026, 30 days before disclosure).

    The latest release, 4.0.1, is not affected.

  • CVE-2026-49264Medium 6.1

    OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

    Affected: from 0.6.1, fixed in 4.0.0.

    Fixed in 4.0.0 (released Sep 28, 2026, 15 days before disclosure).

    The latest release, 4.0.1, is not affected.

  • CVE-2026-49265Medium 6.8

    OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison

    Affected: from 3.0.0, fixed in 4.0.0.

    Fixed in 4.0.0 (released Sep 28, 2026, 15 days before disclosure).

    The latest release, 4.0.1, is not affected.

  • CVE-2022-36087Medium 5.7

    OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI

    Affected: from 3.1.1, fixed in 3.2.1; from 3.1.1, fixed in 3.2.2.

    Fixed in 3.2.2 (released Oct 17, 2022, 38 days after disclosure).

    The latest release, 4.0.1, is not affected.