oauthlib (pypi) has 5 known vulnerabilities, the worst rated HIGH. Upgrade to 4.0.1 or later to clear all of them. No malicious-package signal is recorded.
OAuthlib's token grant handlers can authenticate one client while authorizing the grant type and requested scopes using a different, attacker-supplied clientid…
CyberXYZ does not call a package safe in absolute terms. It records 5 known vulnerabilities for oauthlib (pypi), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does oauthlib have known vulnerabilities?
Yes. CyberXYZ records 5 known vulnerabilities for oauthlib (pypi), the worst rated HIGH. They are GHSA-7984-qgvg-3j9c, GHSA-3jp2-3mrg-2vxc, GHSA-hj66-6f7g-4r5v, GHSA-xpv3-w29h-x7cv, GHSA-3pgj-pg6c-r5p7.
Which version of oauthlib should I use?
4.0.1 or later clears every advisory recorded for oauthlib (pypi). Check the release you pick before installing it.
How do I check oauthlib before installing?
Search oauthlib in CyberXYZ Check at https://cyberxyz.io/check?q=oauthlib. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:43 UTC. The most recent advisory here was published 2026-10-30. Updated continuously from NVD, GHSA, OSV and CNA feeds.