Findings

CVE-2026-49265

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Published Sep 29, 2026 · updated Oct 13, 2026

## Summary A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation of the Authorization Code Grant flow. The function uses Python's standard operator for string comparison instead of a constant-time comparison function, potentially allowing timing-based attacks. ## Affected Component - File: - Functions: , - Vulnerability Type: CWE-208 (Observable Timing Discrepancy) ## Technical Details Python's operator uses short-circuit evaluation when comparing strings: 1. Returns immediately if lengths differ 2. Compares characters left-to-right, stopping at first mismatch This means comparison time varies linearly with the length of the common prefix between the attacker-supplied verifier and the stored challenge, creating a measurable timing oracle. ## Proof of Concept Tested locally against oauthlib source (network jitter eliminated to isolate pure Python execution time): | Input | Result | Time (10M iterations) | |---|---|---| | Wrong first char ( + *49) | Fast reject | 0.34106s | | 49 chars correct ( *49 + ) | Deep compare | 0.37847s | | **Difference** | | **0.03741s** | The ~37ms delta over 10M iterations corresponds to nanosecond-level differences per call, which are statistically exploitable under controlled conditions. ## Attack Scenario 1. Attacker intercepts via Custom URI Scheme Hijacking 2. PKCE blocks token request — attacker lacks 3. Attacker sends repeated requests to endpoint measuring response times 4. Using timing oracle, attacker recovers character by character 5. Attacker obtains Access Token → Account Takeover > **Note:** Practical exploitability is limited due to the single-use nature of > authorization codes and real-world network noise. However, the vulnerable > pattern should be corrected as a defense-in-depth measure. ## Recommended Fix Replace with for constant-time comparison: cr: Elvin Latifli