CVE-2026-49272: falha de alta gravidade em oauthlib
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.3%
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validate_token_request to check that the device_code parameter is present and valid. A caller whose client request is accepted by the configured validator and who knows a valid client ID enabled for the device workflow can submit a missing or bogus device code to the token endpoint and obtain a bearer token without completing device authorization. This issue is fixed in version 4.0.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Produtos afetados
oauthlib · oauthlibCVEs relacionadas — oauthlib
No mesmo produto, das mais perigosas para as menos.
CVE-2022-36087MEDIUMOAuthLib vulnerable DoS when attacker provides malicious IPV6 URIEPSS 1.8%CVE-2026-118669HIGHOAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientEPSS 0.3%CVE-2026-49265MEDIUMOAuthLib: Timing Attack Vulnerability in PKCE code_verifier ComparisonEPSS 0.2%CVE-2026-49264MEDIUMOAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationEPSS 0.2%