CVE-2026-49264
Description
A flaw was found in oauthlib. When JSON with Padding (JSONP) support is enabled on the token revocation endpoint, the application fails to validate user-supplied callback parameters before reflecting them into the response. A remote attacker could exploit this flaw by submitting a crafted callback value, allowing the execution of arbitrary JavaScript code within the security context of client applications consuming the response.
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires a non-default configuration alongside user interaction to execute injected script within the client application's origin. In typical deployments, JSONP processing is disabled by default within oauthlib, leaving standard configurations unaffected. Exposure is limited to custom services that explicitly activate JSONP handling on the token revocation endpoint and process untrusted callback inputs.
Mitigation
JSONP support on oauthlib's token revocation endpoint is opt-in and disabled by default. Deployments can mitigate this issue by not enabling it: ensure enable_jsonp=True is not passed when constructing oauthlib's RevocationEndpoint, so that user-supplied callback parameters are never reflected into JavaScript response bodies. Upstream removed the JSONP feature from RevocationEndpoint entirely in oauthlib 4.0.0.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | N/A | 6.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
