CVE-2026-49265 in OAuthLib

Prediction

by VulDB Data Team • 09/29/2026

A flaw has been found in OAuthLib. Affected is the function code_challenge_method_plain of the file oauthlib/oauth2/rfc6749/grant_types/authorization_code.py of the component PKCE. This manipulation causes observable timing discrepancy. Remote exploitation of the attack is possible.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Moderation: accepted
• Entry: VDB-411686
• CPE: ready
• CWE: CWE-208 (confirmed)
• CVSS: 3.7 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: very low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-49265
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49265
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-49265/