{"schema":"threatline.record/2","record":{"id":"CVE-2026-49265","aliases":["GHSA-xpv3-w29h-x7cv","PYSEC-2026-4114"],"summary":"Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)","details":"## Summary\n\nA timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation \nof the Authorization Code Grant flow. The `code_challenge_method_plain` function \nuses Python's standard `==` operator for string comparison instead of a \nconstant-time comparison function, potentially allowing timing-based attacks.\n\n## Affected Component\n\n- File: `oauthlib/oauth2/rfc6749/grant_types/authorization_code.py`\n- Functions: `code_challenge_method_plain`, `code_challenge_method_s256`\n- Vulnerability Type: CWE-208 (Observable Timing Discrepancy)\n\n## Technical Details\n\nPython's `==` operator uses short-circuit evaluation when comparing strings:\n1. Returns `False` immediately if lengths differ\n2. Compares characters left-to-right, stopping at first mismatch\n\nThis means comparison time varies linearly with the length of the common prefix \nbetween the attacker-supplied verifier and the stored challenge, creating a \nmeasurable timing oracle.\n\n## Proof of Concept\n\nTested locally against oauthlib source (network jitter eliminated to isolate \npure Python execution time):\n\n| Input | Result | Time (10M iterations) |\n|---|---|---|\n| Wrong first char (`B` + `A`*49) | Fast reject | 0.34106s |\n| 49 chars correct (`A`*49 + `B`) | Deep compare | 0.37847s |\n| **Difference** | | **0.03741s** |\n\nThe ~37ms delta over 10M iterations corresponds to nanosecond-level differences \nper call, which are statistically exploitable under controlled conditions.\n\n## Attack Scenario\n\n1. Attacker intercepts `authorization_code` via Custom URI Scheme Hijacking\n2. PKCE blocks token request — attacker lacks `code_verifier`\n3. Attacker sends repeated requests to `/token` endpoint measuring response times\n4. Using timing oracle, attacker recovers `code_verifier` character by character\n5. Attacker obtains Access Token → Account Takeover\n\n> **Note:** Practical exploitability is limited due to the single-use nature of \n> authorization codes and real-world network noise. However, the vulnerable \n> pattern should be corrected as a defense-in-depth measure.\n\n## Recommended Fix\n\nReplace `==` with `hmac.compare_digest()` for constant-time comparison:\n\ncr: Elvin Latifli","categories":["Libraries & packages"],"product":"oauthlib","vendor":"oauthlib","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-xpv3-w29h-x7cv","source_modified_at":"2026-10-13T15:47:41Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"oauthlib"},"range":">= 3.0.0, < 4.0.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","source_modified_at":"2026-10-13T16:19:39.092Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"oauthlib","vendor":"oauthlib","versions":[{"version":">= 3.0.0, < 4.0.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xpv3-w29h-x7cv","source_modified_at":"2026-10-13T16:00:32.097492414Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"oauthlib","purl":"pkg:pypi/oauthlib"},"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"4.0.0"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.2.0","3.2.1","3.2.2","3.3.0","3.3.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-xpv3-w29h-x7cv","source_modified_at":"2026-10-13T15:47:41Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"oauthlib"},"version":"4.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xpv3-w29h-x7cv","source_modified_at":"2026-10-13T16:00:32.097492414Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"oauthlib","purl":"pkg:pypi/oauthlib"},"version":"4.0.0"}],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00375,"percentile":0.30249,"score_date":"2026-10-23"},"published_at":"2026-10-13T15:47:11.854Z","modified_at":"2026-10-13T16:19:39.092Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-xpv3-w29h-x7cv","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-13T15:47:41Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-13T16:19:39.092Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-xpv3-w29h-x7cv","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-13T16:00:32.097492414Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-49265","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/oauthlib/oauthlib/pull/963","tags":["x_refsource_MISC"]},{"url":"https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","source":"GitHub Advisory Database"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49265","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4114.yaml","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-xpv3-w29h-x7cv","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-13T16:19:32.600149Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-13T16:19:39.092Z","content_hash":"4631e9f81be98044db303b458f03718caf9319a7d53b874a22fc0ec8f8653182"}}