GHSA-xpv3-w29h-x7cv: Medium severity pip/oauthlib vulnerability
Summary
A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing timing-based attacks.
Affected Component
- File: oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py - Functions: codechallengemethodplain, codechallengemethods256 - Vulnerability Type: CWE-208 (Observable Timing Discrepancy)
Technical Details
Python's == operator uses short-circuit evaluation when comparing strings: 1. Returns False immediately if lengths differ 2. Compares characters left-to-right, stopping at first mismatch
This means comparison time varies linearly with the length of the common prefix between the attacker-supplied verifier and the stored challenge, creating a measurable timing oracle.
Proof of Concept
Tested locally against oauthlib source (network jitter eliminated to isolate pure Python execution time):
| Input | Result | Time (10M iterations) | |---|---|---| | Wrong first char (B + A49) | Fast reject | 0.34106s | | 49 chars correct (A49 + B) | Deep compare | 0.37847s | | Difference | | 0.03741s |
The ~37ms delta over 10M iterations corresponds to nanosecond-level differences per call, which are statistically exploitable under controlled conditions.
Attack Scenario
1. Attacker intercepts authorizationcode via Custom URI Scheme Hijacking 2. PKCE blocks token request — attacker lacks codeverifier 3. Attacker sends repeated requests to /token endpoint measuring response times 4. Using timing oracle, attacker recovers codeverifier character by character 5. Attacker obtains Access Token → Account Takeover
Note: Practical exploitability is limited due to the single-use nature of authorization codes and real-world network noise. However, the vulnerable pattern should be corrected as a defense-in-depth measure.
Recommended Fix
Replace == with hmac.comparedigest() for constant-time comparison:
cr: Elvin Latifli
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/oauthlibto a version that resolves this vulnerability.Fixed in 4.0.0 - Configuration
Replace Python string equality comparisons using == in code_challenge_method_plain and code_challenge_method_s256 with hmac.compare_digest() to provide constant-time comparison.
oauthlib/oauth2/rfc6749/grant_types/authorization_code.py PKCE code challenge comparison = hmac.compare_digest()
Event History
Frequently Asked Questions
What exploitation conditions are indicated by the advisory?
The severity vector indicates network access, high attack complexity, no required privileges, and required user interaction. The timing measurements were produced locally with network jitter eliminated, so the provided data does not establish how reliably the timing difference can be observed over a real network.
Which OAuth flows or code paths should be reviewed?
Review deployments using oauthlib's Authorization Code Grant PKCE handling, specifically oauthlib/oauth2/rfc6749/grant_types/authorization_code.py. The advisory identifies code_challenge_method_plain and code_challenge_method_s256 as affected functions, with the timing issue specifically described for code_challenge_method_plain.
How can I determine whether my installation contains the vulnerable behavior?
Inspect the identified authorization_code.py implementation for code_challenge_method_plain using Python string equality (==) to compare the verifier-derived value and stored challenge. The supplied data does not provide affected or fixed version numbers.
What can be changed if an update is not immediately available?
The described issue is caused by a non-constant-time string comparison, so the relevant comparison should be replaced with a constant-time comparison function. No configuration-only workaround is provided in the advisory data.