CVE-2026-49265: Medium severity pip/oauthlib vulnerability
Summary
A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing timing-based attacks.
Affected Component
- File: oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py - Functions: codechallengemethodplain, codechallengemethods256 - Vulnerability Type: CWE-208 (Observable Timing Discrepancy)
Technical Details
Python's == operator uses short-circuit evaluation when comparing strings: 1. Returns False immediately if lengths differ 2. Compares characters left-to-right, stopping at first mismatch
This means comparison time varies linearly with the length of the common prefix between the attacker-supplied verifier and the stored challenge, creating a measurable timing oracle.
Proof of Concept
Tested locally against oauthlib source (network jitter eliminated to isolate pure Python execution time):
| Input | Result | Time (10M iterations) | |---|---|---| | Wrong first char (B + A49) | Fast reject | 0.34106s | | 49 chars correct (A49 + B) | Deep compare | 0.37847s | | Difference | | 0.03741s |
The ~37ms delta over 10M iterations corresponds to nanosecond-level differences per call, which are statistically exploitable under controlled conditions.
Attack Scenario
1. Attacker intercepts authorizationcode via Custom URI Scheme Hijacking 2. PKCE blocks token request — attacker lacks codeverifier 3. Attacker sends repeated requests to /token endpoint measuring response times 4. Using timing oracle, attacker recovers codeverifier character by character 5. Attacker obtains Access Token → Account Takeover
Note: Practical exploitability is limited due to the single-use nature of authorization codes and real-world network noise. However, the vulnerable pattern should be corrected as a defense-in-depth measure.
Recommended Fix
Replace == with hmac.comparedigest() for constant-time comparison:
cr: Elvin Latifli
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/oauthlibto a version that resolves this vulnerability.Fixed in 4.0.0 - Compensating control
In oauthlib's `code_challenge_method_plain` and `code_challenge_method_s256` functions in `oauthlib/oauth2/rfc6749/grant_types/authorization_code.py`, replace string comparison using `==` with Python's `hmac.compare_digest()` for constant-time comparison.
Event History
Frequently Asked Questions
What conditions does an attacker need to exploit this issue?
The CVSS vector indicates network reachability, no prior privileges, high attack complexity, and required user interaction. The described technique relies on submitting verifier values and measuring comparison timing to infer a stored challenge one character at a time.
How can I determine whether my deployment is exposed?
Inspect the installed oauthlib Authorization Code Grant implementation, specifically oauthlib/oauth2/rfc6749/grant_types/authorization_code.py. Affected code uses Python's == operator in code_challenge_method_plain to compare the supplied verifier with the stored challenge.
Is the S256 PKCE method confirmed to have the same timing issue?
The affected-component listing includes code_challenge_method_s256, but the technical details specifically identify code_challenge_method_plain and its use of == as the source of the timing oracle. The provided information does not confirm identical behavior for S256.
What is the stated security impact?
The supplied CVSS data rates confidentiality and integrity impact as high, with no availability impact. Exploitation is rated medium severity overall because it requires high attack complexity and user interaction.