Findings

CVE-2026-49264

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Published Sep 29, 2026 · updated Oct 13, 2026

### Summary When , oauthlib's reflects the user-supplied parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence . ### Details The issue is in . When is passed to the constructor, two code paths wrap the response body using the user-supplied parameter: The value comes from HTTP request parameters, either the query string or POST body, via the class in (lines 394-395), which merges query and body parameters into . Any value the client sends as is used verbatim. There is no validation of any kind on the callback parameter: - No check that it is a valid JavaScript identifier - No whitelist of allowed characters - No escaping or sanitization A safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching ). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations. **How the injection works:** An attacker sends a revocation request with a crafted callback value: The server responds with: This is syntactically valid JavaScript. executes as a statement, and comments out the rest of the line. The attacker has full control over the code that appears before the . **Execution context and attack surface:** JSONP works by having a browser load a remote script via . The loaded script executes in the origin of the **including page**, not the remote server. This means a tag on would execute the payload in 's context, not the auth server's context. The impact comes from client-side integrations that consume this endpoint as trusted JSONP. If a legitimate OAuth client includes pointed at the revocation endp