python3Packages.oauthlib

oauthlib 3.3.1 · pkgs/development/python-modules/oauthlib/default.nix

Health

Risk

risk 32 high

+20 2 open advisories
+12 3.3.1 is behind upstream 4.0.0, a major release

Version

3.3.1 4.0.0 available

Channels

master 3.3.1 · nixos-unstable 3.3.1 · nixos-26.05 3.3.1 no channel is behind master

Hydra

succeeded 10y ago

Advisories

GHSA-hj66-6f7g-4r5v medium 6.1 EPSS 0.3% Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation (OSV, for this version)

CVE-2026-49264

GHSA-xpv3-w29h-x7cv medium 6.8 EPSS 0.4% Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208) (OSV, for this version)

CVE-2026-49265

Packaging

meta complete

Packagewhat each field means

Description

Generic, spec-compliant, thorough implementation of the OAuth request-signing logic

Homepage

https://github.com/oauthlib/oauthlib

Changelog

https://github.com/oauthlib/oauthlib/blob/v3.3.1/CHANGELOG.rst

License

BSD-3-Clause

Platforms

31 platforms: Linux, Darwin

Source provenance

not set: built from source

Outputs

out dist

Status

not broken, not insecure, free

Position

pkgs/development/python-modules/oauthlib/default.nix:66

Maintainers

prikhi

Version bumps 0

all open bumps

None open. Upstream has 4.0.0: how to update a package.

Pull requests 0

None open.

Issues 1

python3Packages.oauthlib: security issues < 4.0.0 1.severity: security

#573963 by nixpkgs-security-tracker · opened 3d ago · 0 comments