OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
影響: pip:oauthlib >= 3.3.0, < 4.0.0 → 4.0.0
A call to the token endpoint with a grant type of "urn:ietf:params:oauth:grant-type:device_code" and a bogus device_code is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details [Section 3.4 of the RFC 8628 spec](https://datatracker.ietf.org/doc/html/rfc8628#section-3.4) says that the token endpoint should take in device_code as a required parameter.DeviceCodeGrant.validate_token_request does not perform any validation of device_code. DeviceC…
| CVE | CVE-2026-49272 |
|---|---|
| 情報源 | GitHub Advisory Database |
| 取得日時 | 2026/10/28 06:03 |
| データ | Markdown JSON |
2026/10/27 22:30、GitHub Advisory Databaseが「OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Python。CVE: CVE-2026-49272。