CVE-2013-4346
urbanairship python-oauth2: no CVSS score yet. EPSS 2.4% chance of exploitation in the next 30 days. Fixed in oauth2 1.9rc1.
The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.
- EPSS
- 2.4% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
- CWE
- CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- urbanairship:python-oauth2
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4433-4cxq-vv73 | PyPI | oauth2 | <=1.9rc1 | no fix published |
| PYSEC-2014-85 | PyPI | oauth2 | <1.9rc1 | 1.9rc1 |