Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

requests/requests-oauthlib

              master @ f33dac3
            

Fixes

CVEs

MEDIUM

Peak severity

0.0%

Coverage

Highlights

Credential Leakage: 1 prior fix. Scrutinize any change in this area.

requests_oauthlib/oauth2_session.py: most-fixed (2 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Improper Certificate Validation: The OAuth2Session ignored session-level `verify` configurations when performing POST requests to fetch or refresh tokens, leading to potential fallback issues where certificate validation was not strictly enforced as configured.

Credential Leakage: OAuth2Session inherited the default requests.Session behavior of automatically parsing and transmitting system-wide credentials from the user's .netrc file during standard OAuth request routines, risking unintended credential leakage.