{"action":"Upgrade oauth2 to 1.9rc1 or later.","affected":[{"fixed":"1.9rc1","introduced":"0"}],"component":"oauth2","cve_ids":["CVE-2013-4346"],"ecosystem":"PyPI","epss":0.02429,"exploited":false,"fixed_versions":["1.9rc1"],"ghsa_id":"GHSA-4433-4cxq-vv73","id":"tcs_01M5KG6ERYKXDWEQ82J6YYPNXY","modified_at":"2026-06-10T17:02:26.300609843Z","published_at":"2014-05-20T14:55:00Z","references":["https://osv.dev/vulnerability/PYSEC-2014-85","http://www.openwall.com/lists/oss-security/2013/09/12/7","https://github.com/simplegeo/python-oauth2/issues/129","http://www.securityfocus.com/bid/62386","https://github.com/advisories/GHSA-4433-4cxq-vv73"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2014-85","url":"https://osv.dev/vulnerability/PYSEC-2014-85"}],"summary":"The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL."}