Vulnerabilities for oauthlib

First version without a known vulnerability: 0.0.1

Details

• GHSA-xpv3-w29h-x7cv2026-09-29

  Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

  Fixed in: 4.0.0

• GHSA-hj66-6f7g-4r5v2026-09-29

  Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

  Fixed in: 4.0.0

• GHSA-3pgj-pg6c-r5p72022-09-16

  OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI

  Fixed in: 3.2.2, 2e40b412c844ecc4673c3fa3f72181f228bdbacd, 3.2.1