OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
影響: pip:oauthlib >= 3.3.0, < 4.0.0 → 4.0.0
A call to the token endpoint with a grant type of "urn:ietf:params:oauth:grant-type:device_code" and a bogus device_code is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details [Section 3.4 of the RFC 8628 spec](https://datatracker.ietf.org/doc/html/rfc8628#section-3.4) says that the token endpoint should take in device_code as a required parameter.DeviceCodeGrant.validate_token_request does not perform any validation of device_code. DeviceC…
Read on GitHub Advisory Database
| CVE | CVE-2026-49272 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/28/2026, 06:03 AM |
| Data | Markdown JSON |
On 10/27/2026, 10:30 PM, GitHub Advisory Database published "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow" (type: Advisory). Severity is "High" (high). Related technologies: Python. CVE: CVE-2026-49272.