CVE-2026-49264

A flaw was found in oauthlib. When JSON with Padding (JSONP) support is enabled on the token revocation endpoint, the application fails to validate user-supplied callback parameters before reflecting them into the response. A remote attacker could exploit this flaw by submitting a crafted callback value, allowing the execution of arbitrary JavaScript code within the security context of client applications consuming the response.

This vulnerability is rated as Moderate impact because successful exploitation requires a non-default configuration alongside user interaction to execute injected script within the client application's origin. In typical deployments, JSONP processing is disabled by default within oauthlib, leaving standard configurations unaffected. Exposure is limited to custom services that explicitly activate JSONP handling on the token revocation endpoint and process untrusted callback inputs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

JSONP support on oauthlib's token revocation endpoint is opt-in and disabled by default. Deployments can mitigate this issue by not enabling it: ensure enable_jsonp=True is not passed when constructing oauthlib's RevocationEndpoint, so that user-supplied callback parameters are never reflected into JavaScript response bodies. Upstream removed the JSONP feature from RevocationEndpoint entirely in oauthlib 4.0.0.