Timing side channel in OAuthLib PKCE code_verifier comparison
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 2 fixed, 30 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-208.
Summary
OAuthLib versions from 3.0.0 before 4.0.0 are affected. Its PKCE checks compare the attacker-supplied code_verifier with the stored challenge using ordinary string equality, which leaks timing (CWE-208). A remote attacker who intercepts a single-use authorization code could potentially recover the code_verifier with enough repeated measurements. CISA lists no known exploitation: the CVE is not in KEV and its SSVC exploitation value is none.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in code_challenge_method_plain and code_challenge_method_s256. Because the comparison can return after a length difference or the first mismatching character, repeated token endpoint measurements can reveal common-prefix timing information that could potentially allow recovery of the code_verifier, unauthorized access-token acquisition, and account takeover. Practical exploitation requires an intercepted, single-use authorization code and enough measurements to overcome real-world network noise; the local timing benchmark does not establish practical remote account takeover, so the weakness remains a defense-in-depth concern. This issue is fixed in version 4.0.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| oauthlib | oauthlib | 3.0.0 to before 4.0.0 | 4.0.0 | Patch available | CNA |
| — | oauthlib (PyPI) | 3.0.0 to before 4.0.0 | 4.0.0 | Patch available | GHSA-xpv3-w29h-x7cv |
- oauthlib Vendoroauthlib Affected 3.0.0 to before 4.0.0 Fixed in 4.0.0 Patch available CNA
- oauthlib (PyPI) Vendor— Affected 3.0.0 to before 4.0.0 Fixed in 4.0.0 Patch available GHSA-xpv3-w29h-x7cv
Remediation
Upgrade oauthlib to 4.0.0 on PyPI. Red Hat fixes Red Hat AI Inference Server 3.5 in RHSA-2026:82368 and RHSA-2026:82415, and Red Hat Enterprise Linux AI 3.5 in RHSA-2026:92449 and RHSA-2026:92452. Red Hat lists Confidential Compute Attestation, Fence Agents Remediation Operator, Lightspeed Core, Lightspeed Services for Advanced Cluster Management, Migration Toolkit for Applications 8, and other products as affected without a fix.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA oauthlib (oauthlib) Fixed in 4.0.0
- Fix · GHSA-xpv3-w29h-x7cv oauthlib (PyPI) Fixed in 4.0.0 Advisory →
Red Hat 4 advisories
- RHSA-2026:92452 Released 2026-10-29 · Red Hat rating CriticalRed Hat Enterprise Linux AI 3.5.2 enhancement update
- Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:92449 Released 2026-10-29 · Red Hat rating CriticalRed Hat Enterprise Linux AI 3.5.2 enhancement update
- Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:82415 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (cpu)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
Show 1 more Red Hat advisories
- RHSA-2026:82368 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (cuda)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Fence Agents Remediation Operator | Affected | No fix yet: Fix deferred |
| Lightspeed Core | Affected | No fix yet: Fix deferred |
| Lightspeed Services for Advanced Cluster Management | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Pen Drive Powered by Red Hat Lightspeed | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
| Service Telemetry Framework 1.5 | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server 3.5 | Fixed | RHSA-2026:82368, RHSA-2026:82415 |
| Red Hat Enterprise Linux AI 3.5 | Fixed | RHSA-2026:92449, RHSA-2026:92452 |
Not affected: 6 products
- Red Hat Ceph Storage 4
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux AI 3.5
- Red Hat Lightspeed Services for OCP
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 16.2
Timeline
- 2026-10-13 Threatist record created from CVE-2026-49265
- 2026-10-13 Alias added: GHSA-xpv3-w29h-x7cv
- 2026-10-13 2 new references · GHSA-xpv3-w29h-x7cv
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: MEDIUM → LOW
- 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
- 2026-10-15 Fix available: Red Hat AI Inference Server 3.5 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
- 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
Other 7
- https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv
- https://github.com/oauthlib/oauthlib/pull/963
- https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0
- https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0
- https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4114.yaml
- https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950
- https://github.com/oauthlib/oauthlib
More oauthlib vulnerabilities
- TI-2026-85670 Missing device code check in OAuthLib lets callers get bearer tokens CVSS 3.1HIGH 8.5
- TI-2026-82213 OAuthLib token grants can authorize with another client's identity CVSS 4.0HIGH 8.4
- TI-2026-71760 Unsafe JSONP callback injection in OAuthLib RevocationEndpoint CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-49265 · CVE Program
- CVE-2026-49265 · NVD
- FIRST EPSS
- GHSA-xpv3-w29h-x7cv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-49265 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences