{"id":"CVE-2026-49264","revision":"0d1eef22cb75450799385cceb9a757b9","records":[{"revision":"0d1eef22cb75450799385cceb9a757b9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-49264","aliases":[],"title":"OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation","description":"OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application's origin, with access to its DOM and script-accessible data. The feature is disabled by default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version 4.0.0.","state":0,"publishedAt":"2026-10-13T15:48:40.102+00:00","modifiedAt":"2026-10-16T22:04:46.619+00:00","affected":[{"ecosystem":"Vendor product","name":"oauthlib","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"oauthlib\",\n                    \"product\": \"oauthlib\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.6.1, < 4.0.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1,"severity":"MEDIUM"}],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v","https://github.com/oauthlib/oauthlib/pull/951","https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c","https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-49264","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-49264","identifiers":["CVE-2026-49264"]},"retained":false,"historicalAffected":[]}],"coverage":[]}