## OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

- 種別: advisory
- 重大度: high
- 関連技術: python
- CVE: CVE-2026-49272
- 公開日時: 2026-10-27T13:30:17.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-3jp2-3mrg-2vxc)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-3jp2-3mrg-2vxc

影響: pip:oauthlib >= 3.3.0, < 4.0.0 → 4.0.0
A call to the token endpoint with a grant type of "urn:ietf:params:oauth:grant-type:device_code" and a bogus device_code is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details [Section 3.4 of the RFC 8628 spec](https://datatracker.ietf.org/doc/html/rfc8628#section-3.4) says that the token endpoint should take in device_code as a required parameter.DeviceCodeGrant.validate_token_request does not perform any validation of device_code. DeviceC…