oauthlib vulnerabilities
CVEs whose affected-version data names the oauthlib package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-49272High· 8.5OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
CVE-2026-49265Medium· 6.8OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values …
CVE-2026-49264Medium· 6.1PoCOAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter…