oauthlib has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 6.8 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-49272High· 8.5OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow47CVE-2026-49264Medium· 6.1OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+46CVE-2026-49265Medium· 6.8OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+37
oauthlib vulnerabilities
CVEs affecting oauthlib, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-49272High· 8.5OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
CVE-2026-49265Medium· 6.8OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values …
CVE-2026-49264Medium· 6.1PoCOAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter…