OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

影響: pip:oauthlib >= 3.3.0, < 4.0.0 → 4.0.0

A call to the token endpoint with a grant type of "urn:ietf:params:oauth:grant-type:device_code" and a bogus device_code is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details [Section 3.4 of the RFC 8628 spec](https://datatracker.ietf.org/doc/html/rfc8628#section-3.4) says that the token endpoint should take in device_code as a required parameter.DeviceCodeGrant.validate_token_request does not perform any validation of device_code. DeviceC…

在 GitHub Advisory Database 阅读

2026/10/27 22:30，GitHub Advisory Database 发布了“OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python。CVE：CVE-2026-49272。