Hi,

The following vulnerabilities were published for python-oauthlib.

CVE-2026-49264[0]:
| OAuthLib is an implementation of the OAuth request-signing logic for
| Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint
| in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an
| unvalidated callback request parameter into success and error
| response bodies when enable_jsonp=True. The callback can come from
| the query string or request body and is used without restricting it
| to a legal JavaScript function name. A browser application that
| loads the revocation response as trusted JSONP and permits attacker
| influence over callback can therefore execute attacker-controlled
| JavaScript in the including application's origin, with access to its
| DOM and script-accessible data. The feature is disabled by default,
| so only deployments that explicitly enable JSONP are affected. This
| issue is fixed in version 4.0.0.

https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v
https://github.com/oauthlib/oauthlib/pull/951
https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c (v4.0.0)

CVE-2026-49265[1]:
| OAuthLib is an implementation of the OAuth request-signing logic for
| Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in
| oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare
| attacker-supplied code_verifier values with stored challenges using
| ordinary string equality in code_challenge_method_plain and
| code_challenge_method_s256. Because the comparison can return after
| a length difference or the first mismatching character, repeated
| token endpoint measurements can reveal common-prefix timing
| information that could potentially allow recovery of the
| code_verifier, unauthorized access-token acquisition, and account
| takeover. Practical exploitation requires an intercepted, single-use
| authorization code and enough measurements to overcome real-world
| network noise; the local timing benchmark does not establish
| practical remote account takeover, so the weakness remains a
| defense-in-depth concern. This issue is fixed in version 4.0.0.

https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv
https://github.com/oauthlib/oauthlib/pull/963
https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0 (v4.0.0)


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-49264
https://www.cve.org/CVERecord?id=CVE-2026-49264
[1] https://security-tracker.debian.org/tracker/CVE-2026-49265
https://www.cve.org/CVERecord?id=CVE-2026-49265

Please adjust the affected versions in the BTS as needed.