OAuthLib’s RevocationEndpoint reflected an unvalidated callback parameter into JSONP responses when enable_jsonp was enabled. The callback was not checked to be a legal JavaScript function name, allowing an attacker to supply arbitrary code that would be executed in the victim’s browser context. The executed code can read or modify the DOM, access cookies and other script‑accessible data, and potentially perform further actions as the user.

The flaw exists in OAuthLib versions 0.6.1 through 3.x, inclusive, and is mitigated in v4.0.0. Only deployments that explicitly enable JSONP via the enable_jsonp flag in the RevocationEndpoint are vulnerable. The library is used in Python 3.6+ environments for OAuth2 request signing.

The CVSS score of 6.1 classifies the vulnerability as medium severity. It is not catalogued in the CISA KEV database. The endpoint is reachable over the network, so the attack vector is remote. An attacker who can influence the callback parameter in a revocation request that is processed as trusted JSONP can inject and execute arbitrary JavaScript within the origin of the including application.