{"action":"Upgrade oauth2 to 1.9rc1 or later.","affected":[{"fixed":"1.9rc1","introduced":"0"}],"component":"oauth2","cve_ids":["CVE-2013-4347"],"ecosystem":"PyPI","epss":0.0245,"exploited":false,"fixed_versions":["1.9rc1"],"ghsa_id":"GHSA-rv8h-p43r-4x5r","id":"tcs_01M5KG6EXTJE5Z15DM0T17M2MS","modified_at":"2026-06-10T17:02:26.463030719Z","published_at":"2014-05-20T14:55:00Z","references":["https://osv.dev/vulnerability/PYSEC-2014-86","https://github.com/simplegeo/python-oauth2/issues/9","https://github.com/simplegeo/python-oauth2/pull/146","http://www.openwall.com/lists/oss-security/2013/09/12/7","http://www.securityfocus.com/bid/62388","https://github.com/advisories/GHSA-rv8h-p43r-4x5r"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2014-86","url":"https://osv.dev/vulnerability/PYSEC-2014-86"}],"summary":"The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess"}