OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in code_challenge_method_plain and code_challenge_method_s256. Because the comparison can return after a length difference or the first mismatching character, repeated token endpoint measurements can reveal common-prefix timing information that could potentially allow recovery of the code_verifier, unauthorized access-token acquisition, and account takeover. Practical exploitation requires an intercepted, single-use authorization code and enough measurements to overcome real-world network noise; the local timing benchmark does not establish practical remote account takeover, so the weakness remains a defense-in-depth concern. This issue is fixed in version 4.0.0.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4810-1 advisory.

    - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary     JavaScript response       generation (bsc#1283526).
    - CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (bsc#1283527).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0,     OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-     supplied code_verifier values with stored challenges using ordinary string equality in     code_challenge_method_plain and code_challenge_method_s256. Because the comparison can return after a     length difference or the first mismatching character, repeated token endpoint measurements can reveal     common-prefix timing information that could potentially allow recovery of the code_verifier, unauthorized     access-token acquisition, and account takeover. Practical exploitation requires an intercepted, single-use     authorization code and enough measurements to overcome real-world network noise; the local timing     benchmark does not establish practical remote account takeover, so the weakness remains a defense-in-depth     concern. This issue is fixed in version 4.0.0. (CVE-2026-49265)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22103-1 advisory.

    - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary     JavaScript response       generation (bsc#1283526).
    - CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (bsc#1283527).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0,
    OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-
    supplied code_verifier values with stored challenges using ordinary string equality in
    code_challenge_method_plain and code_challenge_method_s256. Because the comparison can return after a
    length difference or the first mismatching character, repeated token endpoint measurements can reveal
    common-prefix timing information that could potentially allow recovery of the code_verifier, unauthorized
    access-token acquisition, and account takeover. Practical exploitation requires an intercepted, single-use
    authorization code and enough measurements to overcome real-world network noise; the local timing
    benchmark does not establish practical remote account takeover, so the weakness remains a defense-in-depth
    concern. This issue is fixed in version 4.0.0. (CVE-2026-49265)

ID	Name	Product	Family	Type	Severity
370384	SUSE SLED15 / SLES15 Security Update : python-oauthlib (SUSE-SU-2026:4810-1)	Nessus	SuSE Local Security Checks	Local	medium
369152	Linux Distros Unpatched Vulnerability : CVE-2026-49265	Nessus	Misc.	Local	medium
367240	openSUSE 16 Security Update : python-oauthlib (openSUSE-SU-2026:22103-1)	Nessus	SuSE Local Security Checks	Local	medium
475686	Google: dev-python/oauthlib: security update to 20198.0.0	Tenable Cloud Security	Google COS Security Checks	Local	medium
475686	Google: dev-python/oauthlib: security update to 20198.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
475145	Google: dev-python/oauthlib: security update to 19506.549.7	Tenable Cloud Security	Google COS Security Checks	Local	medium
475145	Google: dev-python/oauthlib: security update to 19506.549.7	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
474925	Google: dev-python/oauthlib: security update to 19216.739.5	Tenable Cloud Security	Google COS Security Checks	Local	medium
474925	Google: dev-python/oauthlib: security update to 19216.739.5	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
474889	Google: dev-python/oauthlib: security update to 18867.638.5	Tenable Cloud Security	Google COS Security Checks	Local	medium
474889	Google: dev-python/oauthlib: security update to 18867.638.5	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
461898	Echo: python-oauthlib: security update to 3.2.2-3+e1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
461898	Echo: python-oauthlib: security update to 3.2.2-3+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
448475	SCA: security update for oauthlib (GHSA-xpv3-w29h-x7cv)	Tenable Cloud Security	SCA Checks	Local	medium
448475	SCA: security update for oauthlib (GHSA-xpv3-w29h-x7cv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-49265

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium