HIGH 8.5 GitHub
CVE-2026-49272
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
### Summary
A call to the token endpoint with a grant type of `"urn:ietf:params:oauth:grant-type:device_code"` and a bogus `device_code` is able to get a bearer token as long as they know a valid client ID enabled for the device workflow.
### Details
[Section 3.4 of the RFC 8628 spec](https://datatracker.ietf.org/doc/html/rfc8628#section-3.4) says that the token endpoint should take in `device_code` as a required parameter.`DeviceCodeGrant.validate_token_request` does not perform any validatio
Affected Products
- pip/oauthlib >= 3.3.0, < 4.0.0
References
- https://github.com/advisories/GHSA-3jp2-3mrg-2vxc
- https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc
- https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0
- https://github.com/advisories/GHSA-3jp2-3mrg-2vxc
This high severity vulnerability with a CVSS score of 8.5 was published on 2026-10-27 via GitHub. Affected: pip/oauthlib >= 3.3.0, < 4.0.0.
vulnfeed aggregates 18707 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.