Security audit: pyjwt CVE-2026-102274 (upgrade) and oauthlib CVE-2026-49265 (server-side PKCE, not reachable; allauth pins oauthlib<4) #323

New issue

Closed

opened 2026-09-29 22:10:00 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-09-29 22:10:00 +00:00

Owner

The Security audit job failed on d9013ff7f (run 600). Nothing in that push caused it: two advisories were published against locked dependencies.

Package	Locked	Advisory	Fixed in
`pyjwt`	2.13.0	CVE-2026-102274	2.14.0
`oauthlib`	3.3.1	CVE-2026-49265 (GHSA-xpv3-w29h-x7cv)	4.0.0, released 2026-09-28

pyjwt

A plain upgrade. pyjwt comes in through django-allauth[socialaccount], which accepts <3, and uv lock takes 2.15.1. allauth itself moves from 65.19.2 to 65.19.5 in the same step.

oauthlib: not reachable in Postulo, and not upgradable yet

What the advisory is: a timing side-channel in the PKCE check of the OAuth2 authorization-code grant, on the server side. code_challenge_method_plain and code_challenge_method_s256 in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare with ==, at the token endpoint of an OAuth2 provider.
Why Postulo does not reach it: Postulo is never an OAuth2 provider. It installs allauth.socialaccount with the OpenID Connect provider, which is the client side: signing in with somebody else's identity service. It does not install allauth.idp, and nothing in src/ imports oauthlib.
Why it cannot be upgraded: every django-allauth release up to 65.19.5 requires oauthlib<4,>=3.3.0 for the socialaccount extra, so uv lock cannot take 4.0.0. Forcing it with an override would run allauth against a major version it has not been tested with, on the sign-in path.

What to do

Upgrade pyjwt and django-allauth.
Have pip-audit ignore CVE-2026-49265 by name, with the reason written beside the flag in ci.yml.
Add a test that fails once the lock file holds oauthlib 4 or later, so the exception is removed the moment it stops being needed and cannot outlive its reason.
Add a line to the changelog under Security.

The *Security audit* job failed on `d9013ff7f` (run 600). Nothing in that push caused it: two advisories were published against locked dependencies. | Package | Locked | Advisory | Fixed in | | --- | --- | --- | --- | | `pyjwt` | 2.13.0 | CVE-2026-102274 | 2.14.0 | | `oauthlib` | 3.3.1 | CVE-2026-49265 (GHSA-xpv3-w29h-x7cv) | 4.0.0, released 2026-09-28 | ## pyjwt A plain upgrade. `pyjwt` comes in through `django-allauth[socialaccount]`, which accepts `<3`, and `uv lock` takes 2.15.1. allauth itself moves from 65.19.2 to 65.19.5 in the same step. ## oauthlib: not reachable in Postulo, and not upgradable yet - **What the advisory is:** a timing side-channel in the PKCE check of the OAuth2 authorization-code grant, on the *server* side. `code_challenge_method_plain` and `code_challenge_method_s256` in `oauthlib/oauth2/rfc6749/grant_types/authorization_code.py` compare with `==`, at the token endpoint of an OAuth2 provider. - **Why Postulo does not reach it:** Postulo is never an OAuth2 provider. It installs `allauth.socialaccount` with the OpenID Connect provider, which is the client side: signing in with somebody else's identity service. It does not install `allauth.idp`, and nothing in `src/` imports `oauthlib`. - **Why it cannot be upgraded:** every django-allauth release up to 65.19.5 requires `oauthlib<4,>=3.3.0` for the `socialaccount` extra, so `uv lock` cannot take 4.0.0. Forcing it with an override would run allauth against a major version it has not been tested with, on the sign-in path. ## What to do 1. Upgrade `pyjwt` and `django-allauth`. 2. Have `pip-audit` ignore CVE-2026-49265 by name, with the reason written beside the flag in `ci.yml`. 3. Add a test that fails once the lock file holds `oauthlib` 4 or later, so the exception is removed the moment it stops being needed and cannot outlive its reason. 4. Add a line to the changelog under Security.

tiagoagueda added this to the 0.5.0 milestone

2026-09-29 22:10:00 +00:00

tiagoagueda added the

security

bug

labels

2026-09-29 22:10:00 +00:00

tiagoagueda referenced this issue from a commit

2026-09-30 14:24:43 +00:00

Take PyJWT 2.15.1, and ignore by name the one advisory Postulo cannot reach

tiagoagueda closed this issue

2026-09-30 14:24:43 +00:00