Oauthlib's RevocationEndpoint, when constructed with enable_jsonp=True, reflects the callback parameter from HTTP requests verbatim into JavaScript response bodies on both success and error paths without validating that the callback is a legal JavaScript function name. This lack of validation allows attackers to craft callback values that inject arbitrary JavaScript code, which executes in the context of the client application's origin when the endpoint is consumed as JSONP. The vulnerability arises because the callback parameter is used directly to wrap the response body without sanitization or whitelist checks. This affects oauthlib versions >=0.6.1 and <4.0.0. The default setting for enable_jsonp is False, so only deployments explicitly enabling JSONP are vulnerable. The issue is tracked as CVE-2026-49264 with a CVSS 3.1 score of 6.1 (medium severity).

An attacker who can influence the callback parameter in requests to the RevocationEndpoint with JSONP enabled can inject arbitrary JavaScript code into the response. This code executes in the origin of the client application consuming the JSONP response, potentially leading to cross-site scripting (XSS) attacks. The vulnerability affects client-side integrations relying on JSONP for token revocation, especially in older browsers or cross-origin JavaScript clients. The authorization server effectively becomes a source of attacker-controlled JavaScript code trusted by the client application. However, the vulnerability requires that JSONP support be explicitly enabled and that the attacker can control the callback parameter.

A patch is available for this vulnerability. Users should upgrade oauthlib to a fixed version that properly validates or sanitizes the callback parameter when enable_jsonp=True. Until patched, avoid enabling the JSONP revocation feature or ensure that the callback parameter is strictly validated to allow only safe JavaScript function names matching a whitelist pattern. Since enable_jsonp defaults to False, disabling JSONP support mitigates the risk. Review vendor advisories for the exact fixed versions and apply official updates promptly.