OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application's origin, with access to its DOM and script-accessible data. The feature is disabled by default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version 4.0.0.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4807-1 advisory.

    This update for python-oauthlib fixes the following issue:

    - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary     JavaScript response       generation (bsc#1283526).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4810-1 advisory.

    - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary     JavaScript response       generation (bsc#1283526).
    - CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (bsc#1283527).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0,     OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated     callback request parameter into success and error response bodies when enable_jsonp=True. The callback can     come from the query string or request body and is used without restricting it to a legal JavaScript     function name. A browser application that loads the revocation response as trusted JSONP and permits     attacker influence over callback can therefore execute attacker-controlled JavaScript in the including     application's origin, with access to its DOM and script-accessible data. The feature is disabled by     default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version     4.0.0. (CVE-2026-49264)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22103-1 advisory.

    - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary     JavaScript response       generation (bsc#1283526).
    - CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (bsc#1283527).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0,
    OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated
    callback request parameter into success and error response bodies when enable_jsonp=True. The callback can
    come from the query string or request body and is used without restricting it to a legal JavaScript
    function name. A browser application that loads the revocation response as trusted JSONP and permits
    attacker influence over callback can therefore execute attacker-controlled JavaScript in the including
    application's origin, with access to its DOM and script-accessible data. The feature is disabled by
    default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version
    4.0.0. (CVE-2026-49264)

ID	Name	Product	Family	Type	Severity
370395	SUSE SLED15 / SLES15 Security Update : python-oauthlib (SUSE-SU-2026:4807-1)	Nessus	SuSE Local Security Checks	Local	medium
370384	SUSE SLED15 / SLES15 Security Update : python-oauthlib (SUSE-SU-2026:4810-1)	Nessus	SuSE Local Security Checks	Local	medium
369165	Linux Distros Unpatched Vulnerability : CVE-2026-49264	Nessus	Misc.	Local	medium
367240	openSUSE 16 Security Update : python-oauthlib (openSUSE-SU-2026:22103-1)	Nessus	SuSE Local Security Checks	Local	medium
475690	Google: dev-python/oauthlib: security update to 20198.0.0	Tenable Cloud Security	Google COS Security Checks	Local	medium
475690	Google: dev-python/oauthlib: security update to 20198.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
475150	Google: dev-python/oauthlib: security update to 19506.549.7	Tenable Cloud Security	Google COS Security Checks	Local	medium
475150	Google: dev-python/oauthlib: security update to 19506.549.7	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
474923	Google: dev-python/oauthlib: security update to 19216.739.5	Tenable Cloud Security	Google COS Security Checks	Local	medium
474923	Google: dev-python/oauthlib: security update to 19216.739.5	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
474905	Google: dev-python/oauthlib: security update to 18867.638.5	Tenable Cloud Security	Google COS Security Checks	Local	medium
474905	Google: dev-python/oauthlib: security update to 18867.638.5	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
462970	Echo: python-oauthlib: security update to 3.2.2-3+e1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462970	Echo: python-oauthlib: security update to 3.2.2-3+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
448480	SCA: security update for oauthlib (GHSA-hj66-6f7g-4r5v)	Tenable Cloud Security	SCA Checks	Local	medium
448480	SCA: security update for oauthlib (GHSA-hj66-6f7g-4r5v)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-49264

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium