A flaw was found in oauthlib. When JSON with Padding (JSONP) support is enabled on the token revocation endpoint, the application fails to validate user-supplied callback parameters before reflecting them into the response. A remote attacker could exploit this flaw by submitting a crafted callback value, allowing the execution of arbitrary JavaScript code within the security context of client applications consuming the response.