{"items":[{"id":"NVI-00012089","kind":"vulnerability","title":"Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xpv3-w29h-x7cv","CVE-2026-49265"],"plain_summary":"GitHub lists this reviewed advisory for oauthlib. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0febc33e54c958b9a3752bfec0dffd77"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-13T15:47:41.000Z","value":"6.8 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-a3cc0f00bb3abf8d153bbf173bdd416a"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.242%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.1545. Missing scores are unknown.","source_id":"sr-0febc33e54c958b9a3752bfec0dffd77"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a3cc0f00bb3abf8d153bbf173bdd416a","url":"https://github.com/advisories/GHSA-xpv3-w29h-x7cv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xpv3-w29h-x7cv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:22.124Z"},{"id":"sr-0febc33e54c958b9a3752bfec0dffd77","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-49265","publisher":"FIRST EPSS","observed_at":"2026-11-01T01:39:43.080Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a3cc0f00bb3abf8d153bbf173bdd416a"],"technology":"oauthlib","known_exclusions":[],"conditions_summary":"## Summary\n\nA timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation \nof the Authorization Code Grant flow. The `code_challenge_method_plain` function \nuses Python's standard `==` operator for string comparison instead of a \nconstant-time comparison function, potentially allowing timing-based attacks.\n\n## Affected Component\n\n- File: `oauthlib/oauth2/rfc6749/grant_types/authorization_code.py`\n- Functions: `code_challenge_method_plain`, `code_challenge_method_s256`\n- Vulnerability Type: CWE-208 (Observable Timing Discrepancy)\n\n## Technical Details\n\nPython's `==` operator uses short-circuit evaluation when comparing strings:\n1. Returns `False` immediately if lengths differ\n2. Compares characters left-to-right, stopping at first mismatch\n\nThis means comparison time varies linearly with the length of the common prefix \nbetween the attacker-supplied verifier and the stored challenge, creating a \nmeasurable timing oracle.\n\n## Proof of Concept\n\nTested locally against oauthlib source (network jitter eliminated to isolate \npure Python execution time):\n\n| Input | Result | Time (10M iterations) |\n|---|---|---|\n| Wrong first char (`B` + `A`*49) | Fast reject | 0.34106s |","public_affected_ranges":[">= 3.0.0, < 4.0.0"]}],"null_published_at":"2026-11-01T14:34:14.098Z","source_updated_at":"2026-10-13T15:47:41.000Z","source_disclosed_at":"2026-09-29T17:56:31.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T23:14:22.124Z"},{"id":"NVI-00012089","kind":"vulnerability","title":"Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xpv3-w29h-x7cv","CVE-2026-49265"],"plain_summary":"GitHub lists this reviewed advisory for oauthlib. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a3cc0f00bb3abf8d153bbf173bdd416a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-13T15:47:41.000Z","value":"6.8 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-a3cc0f00bb3abf8d153bbf173bdd416a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a3cc0f00bb3abf8d153bbf173bdd416a","url":"https://github.com/advisories/GHSA-xpv3-w29h-x7cv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xpv3-w29h-x7cv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:22.124Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a3cc0f00bb3abf8d153bbf173bdd416a"],"technology":"oauthlib","known_exclusions":[],"conditions_summary":"## Summary\n\nA timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation \nof the Authorization Code Grant flow. The `code_challenge_method_plain` function \nuses Python's standard `==` operator for string comparison instead of a \nconstant-time comparison function, potentially allowing timing-based attacks.\n\n## Affected Component\n\n- File: `oauthlib/oauth2/rfc6749/grant_types/authorization_code.py`\n- Functions: `code_challenge_method_plain`, `code_challenge_method_s256`\n- Vulnerability Type: CWE-208 (Observable Timing Discrepancy)\n\n## Technical Details\n\nPython's `==` operator uses short-circuit evaluation when comparing strings:\n1. Returns `False` immediately if lengths differ\n2. Compares characters left-to-right, stopping at first mismatch\n\nThis means comparison time varies linearly with the length of the common prefix \nbetween the attacker-supplied verifier and the stored challenge, creating a \nmeasurable timing oracle.\n\n## Proof of Concept\n\nTested locally against oauthlib source (network jitter eliminated to isolate \npure Python execution time):\n\n| Input | Result | Time (10M iterations) |\n|---|---|---|\n| Wrong first char (`B` + `A`*49) | Fast reject | 0.34106s |","public_affected_ranges":[">= 3.0.0, < 4.0.0"]}],"null_published_at":"2026-11-01T01:03:56.629Z","source_updated_at":"2026-10-13T15:47:41.000Z","source_disclosed_at":"2026-09-29T17:56:31.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:14:22.124Z"}],"next_cursor":null,"snapshot_revision":"42594"}