CVE-2026-49265: OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison
Summary
A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing timing-based attacks.
Affected Component
- File: oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py - Functions: codechallengemethodplain, codechallengemethods256 - Vulnerability Type: CWE-208 (Observable Timing Discrepancy)
Technical Details
Python's == operator uses short-circuit evaluation when comparing strings: 1. Returns False immediately if lengths differ 2. Compares characters left-to-right, stopping at first mismatch
This means comparison time varies linearly with the length of the common prefix between the attacker-supplied verifier and the stored challenge, creating a measurable timing oracle.
Proof of Concept
Tested locally against oauthlib source (network jitter eliminated to isolate pure Python execution time):
| Input | Result | Time (10M iterations) | |---|---|---| | Wrong first char (B + A49) | Fast reject | 0.34106s | | 49 chars correct (A49 + B) | Deep compare | 0.37847s | | Difference | | 0.03741s |
The ~37ms delta over 10M iterations corresponds to nanosecond-level differences per call, which are statistically exploitable under controlled conditions.
Attack Scenario
1. Attacker intercepts authorizationcode via Custom URI Scheme Hijacking 2. PKCE blocks token request — attacker lacks codeverifier 3. Attacker sends repeated requests to /token endpoint measuring response times 4. Using timing oracle, attacker recovers codeverifier character by character 5. Attacker obtains Access Token → Account Takeover
Note: Practical exploitability is limited due to the single-use nature of authorization codes and real-world network noise. However, the vulnerable pattern should be corrected as a defense-in-depth measure.
Recommended Fix
Replace == with hmac.comparedigest() for constant-time comparison:
cr: Elvin Latifli
Other sources
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in codechallengemethodplain and codechallengemethods256. Because the comparison can return after a length difference or the first mismatching character, repeated token endpoint measurements can reveal common-prefix timing information that could potentially allow recovery of the codeverifier, unauthorized access-token acquisition, and account takeover. Practical exploitation requires an intercepted, single-use authorization code and enough measurements to overcome real-world network noise; the local timing benchmark does not establish practical remote account takeover, so the weakness remains a defense-in-depth concern. This issue is fixed in version 4.0.0.
— NVD
OAuthLib: Timing Attack Vulnerability in PKCE codeverifier Comparison
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/oauthlibto a version that resolves this vulnerability.Fixed in 4.0.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.2.2-4 - Upgrade
Upgrade
oauthlibto a version that resolves this vulnerability.Fixed in 4.0.0
Event History
Frequently Asked Questions
What conditions does an attacker need to exploit this issue?
The CVSS vector indicates network reachability, no prior privileges, high attack complexity, and required user interaction. The described technique relies on submitting verifier values and measuring comparison timing to infer a stored challenge one character at a time.
How can I determine whether my deployment is exposed?
Inspect the installed oauthlib Authorization Code Grant implementation, specifically oauthlib/oauth2/rfc6749/grant_types/authorization_code.py. Affected code uses Python's == operator in code_challenge_method_plain to compare the supplied verifier with the stored challenge.
Is the S256 PKCE method confirmed to have the same timing issue?
The affected-component listing includes code_challenge_method_s256, but the technical details specifically identify code_challenge_method_plain and its use of == as the source of the timing oracle. The provided information does not confirm identical behavior for S256.
What is the stated security impact?
The supplied CVSS data rates confidentiality and integrity impact as high, with no availability impact. Exploitation is rated medium severity overall because it requires high attack complexity and user interaction.