From f3510969587daff0de06a233cf6be3a6233b3429 Mon Sep 17 00:00:00 2001 From: Jonathan Huot Date: Sat, 11 Jul 2026 13:15:29 +0200 Subject: [PATCH] Improve PKCE code comparison (cherry picked from commit 74664d3fe037a354e180e305135c6bab1747a6b0) CVE: CVE-2026-49265 Upstream-Status: Backport [https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0] Dropped changes to the CHANGELOG file. Signed-off-by: Ankur Tyagi --- oauthlib/oauth2/rfc6749/grant_types/authorization_code.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py index 09dc619..c73314a 100644 --- a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py +++ b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py @@ -4,6 +4,7 @@ oauthlib.oauth2.rfc6749.grant_types """ import base64 import hashlib +import hmac import json import logging @@ -44,9 +45,10 @@ def code_challenge_method_s256(verifier, challenge): .. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3 """ - return base64.urlsafe_b64encode( + expected = base64.urlsafe_b64encode( hashlib.sha256(verifier.encode()).digest() - ).decode().rstrip('=') == challenge + ).decode().rstrip('=') + return hmac.compare_digest(expected, challenge) def code_challenge_method_plain(verifier, challenge): @@ -58,7 +60,7 @@ def code_challenge_method_plain(verifier, challenge): .. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3 """ - return verifier == challenge + return hmac.compare_digest(verifier, challenge) class AuthorizationCodeGrant(GrantTypeBase):