# CVE-2026-49265: OAuthlib timing attack in PKCE code_verifier comparison

Source: https://junglewise.ai/threats/cve-2026-49265-oauthlib-timing-attack-vulnerability-in-pkce-code-verifier  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-49265 · Severity: medium · CVSS 6.8 · Published 2026-10-13

OAuthlib, an open-source library used in OAuth 2.0 implementations, contains a timing side-channel vulnerability in its PKCE code verification logic. An attacker could potentially recover the code_verifier through careful measurement of response times during repeated token requests, potentially leading to account takeover. While real-world exploitation is difficult due to network noise and single-use authorization codes, the vulnerability represents a security weakness in authentication flows.

Technologies: [OAuthlib](https://junglewise.ai/threats/technologies/oauthlib-oauthlib), [oauthlib (PyPI)](https://junglewise.ai/threats/technologies/oauthlib). Vendors: [OAuthlib](https://junglewise.ai/threats/vendors/oauthlib), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-49265 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49265 being exploited in the wild.

**How severe is CVE-2026-49265?** Medium severity, with a CVSS score of 6.8, published 13 October 2026.

**Which products and versions are affected?** oauthlib (PyPI) >= 3.0.0, < 4.0.0, ECOSYSTEM:introduced=3.0.0,fixed=4.0.0.

**Is there a fix for CVE-2026-49265?** Yes. oauthlib (PyPI): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49265 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49265?** Check whether you run OAuthlib or oauthlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- oauthlib (PyPI): upgrade to 4.0.0 or later

  ```sh
  pip install "oauthlib>=4.0.0"
  ```


## Technical details

The vulnerability exists in the `code_challenge_method_plain` and `code_challenge_method_s256` functions in `authorization_code.py`, which use Python's non-constant-time `==` operator for string comparison instead of `hmac.compare_digest()`. This allows an attacker to determine the correct characters of a code_verifier one at a time by measuring timing differences in repeated comparisons, exploitable when the attacker can measure response times from the `/token` endpoint with sufficient precision.

## Affected products

- OAuthlib OAuthlib

## Identifiers

- CVE-2026-49265
- GHSA-xpv3-w29h-x7cv
- PYSEC-2026-4114

## Timeline

- 2026-09-29: disclosed

## Related threats

- [OAuthLib device code grant missing validation](https://junglewise.ai/threats/cve-2026-49272-oauthlib-bearer-token-can-be-retrieved-as-long-as-client-knows-a)
- [OAuthLib client authentication bypass in token grants](https://junglewise.ai/threats/cve-2026-118669-oauthlib-is-an-implementation-of-the-oauth-request-signing-logic)
- [oauthlib unsafe JSONP callback injection in RevocationEndpoint](https://junglewise.ai/threats/cve-2026-49264-oauthlib-unsafe-jsonp-callback-injection-in-revocationendpoint)
- [oauthlib denial of service in URI validation with malicious IPv6](https://junglewise.ai/threats/cve-2022-36087-oauthlib-denial-of-service-in-uri-validation-with-malicious-ipv6)