Threats Tagged 'cve-2026-49265'

A timing side-channel vulnerability exists in oauthlib's PKCE implementation for the Authorization Code Grant flow. The vulnerable functions use Python's standard string equality operator instead of a constant-time comparison, enabling attackers to measure timing differences and potentially recover the code_verifier. This flaw affects oauthlib versions from 3.0.0 up to but not including 4.0.0. Although practical exploitation is limited due to network noise and the single-use nature of authorization codes, the vulnerability poses a risk of account takeover if exploited. A patch is available that replaces the vulnerable comparison with a constant-time function.