← Packages
python-oauthlib
An implementation of the OAuth request-signing logic
- Current
- 3.3.1
- Candidate
- 4.0.1
- License
- BSD-3-Clause
RuntimeDeps
Optional RuntimeDeps
| Dependency | Observed source | Current requirement | Candidate requirement |
|---|---|---|---|
1.9.0 | |||
50.0.2 | |||
2.14.0 |
Dependency conditions
- Applies when (any)
- extra == "signals"
- Applies when (any)
- extra == "rsa"extra == "signedtoken"
- Applies when (any)
- extra == "signedtoken"
Advisory · 4
Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.
- Summary
- OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientOSV
- Fixed events
- 4.0.0OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.312%FIRST
- Returned advisory
- GHSA-7984-qgvg-3j9cOSV
- Aliases
- GHSA-7984-qgvg-3j9cOSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:NOSV
- Summary
- Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationOSVOSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.234%FIRST
- Returned advisory
- GHSA-hj66-6f7g-4r5vOSV
- Returned advisory
- PYSEC-2026-4113OSV
- Aliases
- GHSA-hj66-6f7g-4r5v, PYSEC-2026-4113OSV
- KEV
- NoCISA
- Summary
- OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflowOSV
- Fixed events
- 4.0.1OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.328%FIRST
- Returned advisory
- GHSA-3jp2-3mrg-2vxcOSV
- Aliases
- GHSA-3jp2-3mrg-2vxcOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:NOSV
Description
OAuthLib is a generic utility which implements the logic of OAuth without assuming a specific HTTP request object or web framework. Use it to graft OAuth client support onto your favorite HTTP library, or provider support onto your favourite web framework. If you're a maintainer of such a library, write a thin veneer on top of OAuthLib and get OAuth support for very little effort.
Changelog
PR · 7
Checks
| Monitor | Observation | Last checked |
|---|---|---|
Checked | ||
Checked | ||
Checked | ||
Checked | ||
Not configured No reliable monitor identity/configuration. | — | |
Checked Compared same-provider, same-project SPDX metadata for this version pair. | Last attempted | |
Checked | Last attempted | |
Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated. | Last attempted | |
Checked |