Threats tagged 'ghsa-hj66-6f7g-4r5v'

Oauthlib's RevocationEndpoint with JSONP enabled (enable_jsonp=True) reflects the user-supplied callback parameter directly into JavaScript responses without validation. This allows attackers who can influence the callback parameter to inject arbitrary JavaScript code into the response, leading to unsafe JSONP usage. The vulnerability affects oauthlib versions from 0.6.1 up to but not including 4.0.0. The issue is fixed in version 4.0.0.