Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-49264, stems from an unsafe JSONP callback injection in oauthlib's RevocationEndpoint. When the enable_jsonp flag is set to True, the create_revocation_response method directly reflects the user-supplied callback parameter into the JavaScript response body without any validation. This allows an attacker to inject arbitrary JavaScript code, which will then be executed in the context of any client application that consumes this JSONP endpoint. The patch addresses this by completely removing the JSONP functionality, indicating that the presence of this feature without proper validation was the root cause. Therefore, the create_revocation_response method is the primary vulnerable function as it performs the direct injection, and the __init__ method of RevocationEndpoint is also considered vulnerable because it provides the enable_jsonp configuration that activates the vulnerable code path.
RevocationEndpoint.create_revocation_responseoauthlib/oauth2/rfc6749/endpoints/revocation.py
RevocationEndpoint.__init__oauthlib/oauth2/rfc6749/endpoints/revocation.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| oauthlib | pip | >= 0.6.1, <= 3.3.1 | 4.0.0 |