Is CVE-2026-49265 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49265 being exploited in the wild.

How severe is CVE-2026-49265?

Medium severity, with a CVSS score of 6.8, published 13 October 2026.

Which products and versions are affected?

oauthlib (PyPI) >= 3.0.0, < 4.0.0, ECOSYSTEM:introduced=3.0.0,fixed=4.0.0.

Is there a fix for CVE-2026-49265?

Yes. oauthlib (PyPI): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49265 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49265?

Check whether you run OAuthlib or oauthlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49265: OAuthlib timing attack in PKCE code_verifier comparison

Q: Is there a fix for CVE-2026-49265?

Yes. oauthlib (PyPI): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49265 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49265?

Check whether you run OAuthlib or oauthlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49265 · Severity: medium · CVSS 6.8 · Published 2026-10-13

OAuthlib, an open-source library used in OAuth 2.0 implementations, contains a timing side-channel vulnerability in its PKCE code verification logic. An attacker could potentially recover the code_verifier through careful measurement of response times during repeated token requests, potentially leading to account takeover. While real-world exploitation is difficult due to network noise and single-use authorization codes, the vulnerability represents a security weakness in authentication flows.

Technologies: OAuthlib, oauthlib (PyPI). Vendors: OAuthlib, PyPI.

Quick answers

Is CVE-2026-49265 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49265 being exploited in the wild.
How severe is CVE-2026-49265?: Medium severity, with a CVSS score of 6.8, published 13 October 2026.
Which products and versions are affected?: oauthlib (PyPI) >= 3.0.0, < 4.0.0, ECOSYSTEM:introduced=3.0.0,fixed=4.0.0.
Is there a fix for CVE-2026-49265?: Yes. oauthlib (PyPI): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49265 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49265?: Check whether you run OAuthlib or oauthlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

oauthlib (PyPI): upgrade to 4.0.0 or later
```
pip install "oauthlib>=4.0.0"
```

Technical details

The vulnerability exists in the `code_challenge_method_plain` and `code_challenge_method_s256` functions in `authorization_code.py`, which use Python's non-constant-time `==` operator for string comparison instead of `hmac.compare_digest()`. This allows an attacker to determine the correct characters of a code_verifier one at a time by measuring timing differences in repeated comparisons, exploitable when the attacker can measure response times from the `/token` endpoint with sufficient precision.

Affected products

OAuthlib OAuthlib

Identifiers

CVE-2026-49265
GHSA-xpv3-w29h-x7cv
PYSEC-2026-4114

Timeline

2026-09-29: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.