Security feed
Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)
Summary A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation of the Authorization Code Grant flow. The code_challenge_method_plain function uses Python's standard == operator for string com…