CVE-2026-49264

Deferred Deferred - Pending Action

JSONP Callback Reflection in OAuthLib

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application's origin, with access to its DOM and script-accessible data. The feature is disabled by default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version 4.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-49264

EUVD

EUVD-2026-98834

Affected Vendors & Products

Vendor	Product	Version / Range
oauthlib	oauthlib	>= 0.6.1, < 4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-49264 is a vulnerability in OAuthLib where the RevocationEndpoint's JSONP callback feature allows arbitrary JavaScript injection. When enable_jsonp=True, the library reflects user-supplied callback values directly into response bodies without validation, enabling attackers to inject malicious JavaScript code. This occurs in both success and error responses, allowing payloads like alert(document.cookie)// to execute in the client's origin when the response is loaded as JSONP.

Detection Guidance

Check if your OAuthLib version is between 0.6.1 and 3.3.1 by running: pip show oauthlib. If enable_jsonp=True is set in RevocationEndpoint configurations, the system is vulnerable. Inspect network traffic for JSONP callback parameters in revocation responses.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of a user's browser session when JSONP is enabled. This could lead to theft of sensitive data like session cookies, DOM manipulation, or unauthorized actions on behalf of the user. The impact is limited to deployments that explicitly enable JSONP, as the feature is disabled by default.

Compliance Impact

This vulnerability primarily impacts compliance with data protection regulations like GDPR and HIPAA by enabling cross-site scripting (XSS) attacks through JSONP callback injection. Attackers could execute malicious JavaScript in a user's browser, potentially accessing or manipulating sensitive data, which violates GDPR's integrity and confidentiality principles and HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade OAuthLib to version 4.0.0 or later. Disable JSONP in RevocationEndpoint by removing enable_jsonp=True. Replace JSONP with CORS headers for cross-origin requests. Review and update OAuth2 provider configurations to remove JSONP-related parameters.

Hi! I’m here to help you understand CVE-2026-49264. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70