Most recent entries from all

BREW-ansible-CVE-2026-49264 — Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Affected: Homebrew: ansible

### Summary

When `enable_jsonp=True`, oauthlib's `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.

### Details

The issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.

When `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:

```python # Error response path (line 72-73): if self.enable_jsonp and request.callback: response_body = '{}({});'.format(request.callback, response_body)

# Success response path (line 81-82): if self.enable_jsonp and request.callback: response_body = request.callback + '();' ```

The `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.

There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization

A safe JSONP imple…

CLEANSTART-2026-JM52525 — Security fix for CVE-2026-49264 applied in: k8s-sidecar 2.8.2-r1

Affected: CleanStart: k8s-sidecar

Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details.

fkie_cve-2026-49264

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application's origin, with access to its DOM and script-accessible data. The feature is disabled by default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version 4.0.0.

GHSA-hj66-6f7g-4r5v — Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Affected: PyPI: oauthlib

### Summary

### Details

The issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.

When `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:

```python # Error response path (line 72-73): if self.enable_jsonp and request.callback: response_body = '{}({});'.format(request.callback, response_body)

# Success response path (line 81-82): if self.enable_jsonp and request.callback: response_body = request.callback + '();' ```

There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization

A safe JSONP imple…

openSUSE-SU-2026:11973-1 — python313-oauthlib-4.0.0-1.1 on GA media

python313-oauthlib-4.0.0-1.1 on GA media

PYSEC-2026-4113 — Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Affected: PyPI: oauthlib

### Summary

### Details

The issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.

When `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:

```python # Error response path (line 72-73): if self.enable_jsonp and request.callback: response_body = '{}({});'.format(request.callback, response_body)

# Success response path (line 81-82): if self.enable_jsonp and request.callback: response_body = request.callback + '();' ```

There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization

A safe JSONP imple…

RHSA-2026:82368 — Red Hat Security Advisory: Red Hat AI Inference 3.5.2 (cuda)

libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory pip: pip: Arbitrary file installation via malicious package indexes GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3: urllib3: Denial of Service due to excessive HTTP response decompression vim: Vim: Arbitrary Code Execution via crafted directory names vim: Vim: Arbitrary code execution via crafted step-definition patterns oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery vim: Vim: Arbitrary code execution via Python omni-completion acl: Symlink traversal privilege escalation via libacl functions linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module vim: Vim: Out-of-bounds Write in Spell File Word Count vim: Vim: Denial of Service via stack out-of-bounds write in spell_soun…

SUSE-SU-2026:24139-1 — Security update for python-oauthlib

Security update for python-oauthlib