{"id":"ghsa-ghsa-3jp2-3mrg-2vxc","seq":1708830,"kind":"advisory","title":"OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow","url":"https://github.com/advisories/GHSA-3jp2-3mrg-2vxc","permalink":"https://vulnpulse.app/items/ghsa-ghsa-3jp2-3mrg-2vxc","summary":"影響: pip:oauthlib >= 3.3.0, < 4.0.0 → 4.0.0\nA call to the token endpoint with a grant type of \"urn:ietf:params:oauth:grant-type:device_code\" and a bogus device_code is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details [Section 3.4 of the RFC 8628 spec](https://datatracker.ietf.org/doc/html/rfc8628#section-3.4) says that the token endpoint should take in device_code as a required parameter.DeviceCodeGrant.validate_token_request does not perform any validation of device_code. DeviceC…","severity":"high","techs":["python"],"cves":["CVE-2026-49272"],"tags":["GHSA-3jp2-3mrg-2vxc","oauthlib"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T13:30:17.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}