CVE-2026-49264

Executive Summary

CVE-2026-49264 is a cross-site scripting (XSS) vulnerability in OAuthLib, a Python implementation of OAuth request-signing logic, affecting versions 0.6.1 through all releases prior to 4.0.0. The flaw resides in the RevocationEndpoint class within oauthlib/oauth2/rfc6749/endpoints/revocation.py, where an unvalidated callback parameter is reflected into JSONP response bodies when the non-default enable_jsonp=True option is configured. Only deployments that explicitly enable JSONP on the token revocation endpoint are affected; organizations using default configurations are not exploitable. A successful attack allows execution of attacker-controlled JavaScript in the origin of a browser application that consumes the revocation response as trusted JSONP, yielding access to that application's DOM and script-accessible data.

Technical Analysis

The vulnerability is a classic reflected cross-site scripting (XSS) issue (CWE-79) with a JSONP-specific attack surface. OAuthLib provides a RevocationEndpoint implementation for the OAuth 2.0 token revocation flow (RFC 7009). When enable_jsonp=True is set, the endpoint wraps its success or error response bodies in a JavaScript callback function, with the callback name taken directly from the incoming request.

The critical weakness is the absence of validation on the callback parameter. The description states the callback "can come from the query string or request body and is used without restricting it to a legal JavaScript function name." RFC-compliant JSONP implementations are expected to strictly validate the callback token against a safe pattern (for example, ^[a-zA-Z0-9_$.]+$) before reflecting it, because JSONP responses are executed as script by the consuming browser. Without this restriction, an attacker can supply a callback value containing arbitrary script, which is then emitted inside the response body the browser executes.

Because the reflection originates from the revocation endpoint and the feature is gated behind an explicit opt-in (enable_jsonp=True), the affected population is narrow: deployments that both expose a reachable revocation endpoint and deliberately turn on JSONP. The default configuration (enable_jsonp=False) is unaffected, as the callback is not reflected and responses are returned as plain JSON.

The CVSS 3.1 vector reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) issue that requires victim interaction (UI:R) and crosses a trust boundary (S:C, scope change) — the vulnerable script executes in the origin of the application embedding the JSONP, not the OAuthLib host itself. Confidentiality and integrity impacts are low (C:L/I:L), with no availability impact (A:N).

No public proof-of-concept, exploit code, or Nuclei template is known at this time.

Exploitation Scenarios

The attack chain for this vulnerability class (reflected XSS via JSONP callback injection) proceeds as follows. No public PoC is available; the chain below is inferred from the vulnerability class and the details in the NVD description. Specific function, class, parameter, and path names are used only where they appear verbatim in the source description.

1. Reconnaissance / target identification. The attacker identifies a browser-based application that consumes OAuthLib's revocation endpoint as trusted JSONP. This requires the target deployment to have been configured with enable_jsonp=True on the revocation endpoint — a non-default setting. The attacker must also determine that they can influence, or have influenced, the callback value carried to the revocation response (via query string or request body).

2. Triggering the flaw. The attacker crafts a request to the revocation endpoint (oauthlib/oauth2/rfc6749/endpoints/revocation.py) that includes a callback parameter whose value is not a legal JavaScript function name but rather malicious script content. The callback may be injected through either the query string or the request body, both of which the endpoint accepts as sources.

3. Payload / execution. When JSONP is enabled, the endpoint reflects this unvalidated callback value directly into the success or error response body. Because the consuming browser application treats the revocation response as trusted JSONP and executes it as script, the attacker-controlled JavaScript executes in the including application's origin — not the OAuthLib server's origin. This is the scope-change element of CVSS (S:C).

4. Post-exploitation impact. With script running in the application's origin, the attacker gains access to that origin's DOM and any script-accessible data. This can include reading page content, manipulating the interface, stealing data exposed to client-side scripts, or performing actions on behalf of a victim interacting with a malicious page (UI:R). The practical blast radius is bounded by what the embedding application exposes to script in its own origin. Because the feature is opt-in, exploitation is contingent on the specific deployment configuration rather than a universal exposure.

There is no evidence of active exploitation in the wild, and CISA KEV does not list this CVE.

Impact Assessment

The vulnerability enables cross-site scripting in the context of a consumer application that loads OAuthLib's revocation response as JSONP. CVSS assigns a base score of 6.1 (Medium), reflecting:

• Attack Vector (N): reachable over the network.
• Attack Complexity (L): no specialized conditions beyond the opt-in JSONP configuration and callback influence.
• Privileges Required (N): no authentication required to craft the callback-bearing request.
• User Interaction (R): a victim must load/interact with attacker-affected content.
• Scope (C): the impact crosses into the consuming application's origin, exceeding the vulnerable component's own security authority.
• Confidentiality (L) / Integrity (L): limited exposure and modification of script-accessible data in the including origin.
• Availability (N): no denial-of-service effect.

Blast radius is narrow and configuration-dependent. Only deployments that explicitly set enable_jsonp=True on the revocation endpoint are exposed. Organizations running default OAuthLib configurations are not affected. The downstream risk is borne primarily by browser applications that trust the JSONP response — these face potential session-data exposure, UI manipulation, or client-side action forgery within their own origin. Because EPSS has not been scored by FIRST.org, no probabilistic exploitation likelihood can be cited here.

Detection Guidance

Sigma Rule

title: Possible OAuthLib JSONP Callback XSS Attempt (CVE-2026-49264)
id: 8f2c1a44-9b7e-4d3a-a1c2-oauthlibjs0n
status: experimental
description: Detects requests to OAuth token revocation endpoints carrying callback parameters that deviate from a legal JavaScript identifier, indicative of JSONP reflected XSS abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-49264
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/revoke'
      - '/revocation'
  selection_callback:
    cs-uri-query|contains:
      - 'callback='
      - 'callback%3D'
  filter_legit:
    cs-uri-query|re: 'callback=[a-zA-Z0-9_.$]+(&|$)'
  condition: selection_endpoint and selection_callback and not filter_legit
falsepositives:
  - Legitimate JSONP clients using unusual but valid callback names
level: medium
tags:
  - attack.t1190
  - cwe.79

YARA Rule

rule CVE_2026_49264_OAuthLib_JSONP_XSS
{
    meta:
        description = "Detects OAuthLib source reflecting unvalidated callback into JSONP responses"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-49264"
        date = "2026-01-01"
        cve = "CVE-2026-49264"

    strings:
        $s1 = "enable_jsonp" ascii
        $s2 = "RevocationEndpoint" ascii
        $s3 = "revocation.py" ascii
        $s4 = "callback" ascii
        $p1 = "def create_revocation_response" ascii
        $p2 = "jsonp" ascii nocase

    condition:
        uint16(0) == 0x2123 or
        ( ( $s1 and $s2 ) or ( $s3 and $s1 and $p2 ) ) or
        ( $s4 and $p1 and $p2 )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-49264 OAuthLib JSONP Callback XSS Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"revocation"; http.uri; content:"callback"; pcre:"/callback=(?![a-zA-Z0-9_.$]+(?:&|$))[^&]*[<>()'\"]/i"; reference:cve,2026-49264; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-49264; classtype:web-application-attack; sid:202649264; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ http where url.path : ("*revocation*" or "*revoke*") and url.query : "callback=*" and not url.query : r"callback=[a-zA-Z0-9_.$]+(&|$)" ]

Splunk SPL Query

index=web OR index=proxy
| eval endpoint=coalesce(uri_path, url, cs_uri_stem)
| eval query=coalesce(uri_query, cs_uri_query)
| where (like(endpoint, "%revocation%") OR like(endpoint, "%revoke%"))
| where like(query, "%callback=%")
| eval cb=mvindex(split(mvindex(split(query,"callback="),1), "&"),0)
| where NOT match(cb, "^[a-zA-Z0-9_.$]+$")
| table _time, src_ip, endpoint, query, cb
| sort - _time

Wazuh OSSEC Rule

<group name="web,oauthlib,cve-2026-49264">
  <rule id="100264" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>revocation|revoke</url>
    <regex>callback=(?!\w+(?:&amp;|$))</regex>
    <description>CVE-2026-49264: Possible OAuthLib JSONP callback XSS attempt against revocation endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_49264,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The fix is reported as included in OAuthLib 4.0.0 per the GHSA advisory. Because only a single source asserts the patched version and no independent confirmation is available, treat this as provisional and validate against the vendor's release notes before relying on it.

1. Immediate mitigations.

   • Disable JSONP. Ensure enable_jsonp is set to False (its default) on the RevocationEndpoint configuration. Deployments with JSONP disabled are not vulnerable per the description.
   • Where JSONP cannot be disabled but the risk must be reduced, enforce a strict callback allowlist at the reverse proxy or application gateway, rejecting any callback value containing characters outside a legal JavaScript function-name pattern (for example, ^[a-zA-Z0-9_.$]+$).

2. Patch / upgrade steps.

   • Upgrade OAuthLib to 4.0.0 (reported fix). Verify the installed version against the hosted advisory and confirm the changelog entry before closing the finding, since the patch claim is single-sourced.
   • Re-test the revocation endpoint with enable_jsonp=True after upgrade to confirm the callback is no longer reflected unvalidated.
   • If operating from an internal fork or vendored copy, backport the callback validation logic into your copy.

3. Long-term hardening.

   • Abolish reliance on JSONP for OAuth token operations; migrate to CORS-based JSON responses, which do not execute reflected content as script.
   • Apply strict, allowlist-based input validation to any parameter reflected into a response body, especially those rendered into script contexts (output encoding / contextual escaping).
   • Treat callback parameters as untrusted and validate them server-side against a strict lexical grammar.
   • Maintain SCA/SBOM monitoring to track OAuthLib versions across all services and detect regression.
   • Keep the token revocation endpoint on default (JSONP-disabled) settings unless a formal, security-reviewed exception is approved.

References

• NVD — CVE-2026-49264: https://nvd.nist.gov/vuln/detail/CVE-2026-49264
• GitHub Security Advisory (GHSA) for OAuthLib (patch source; fix stated in 4.0.0)
• OAuthLib project repository and release notes (version 4.0.0)
• OWASP — Cross Site Scripting (XSS) and JSONP security guidance
• CWE-79 — Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html

No public proof-of-concept, exploit code, or in-the-wild exploitation evidence is known for CVE-2026-49264 at the time of writing. The CVE is not listed in CISA KEV, and EPSS has not been scored by FIRST.org.