OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
影響: pip:oauthlib >= 3.3.0, < 4.0.0 → 4.0.0
A call to the token endpoint with a grant type of "urn:ietf:params:oauth:grant-type:device_code" and a bogus device_code is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details [Section 3.4 of the RFC 8628 spec](https://datatracker.ietf.org/doc/html/rfc8628#section-3.4) says that the token endpoint should take in device_code as a required parameter.DeviceCodeGrant.validate_token_request does not perform any validation of device_code. DeviceC…
| CVE | CVE-2026-49272 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 28. 오전 06:03 |
| 데이터 | Markdown JSON |
2026. 10. 27. 오후 10:30, GitHub Advisory Database에서 "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python. CVE: CVE-2026-49272.