Improper Authentication in oauthlib - CVE-2026-49272
Published: October 25, 2026
Vulnerability identifier: #VU157644
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49272
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to obtain a bearer token without a valid device code and gain unauthorized access to resources accessible with that token.
The vulnerability exists due to missing device code validation in oauthlib's DeviceCodeGrant.validate_token_request method when processing device authorization grant requests. A remote user can submit a token endpoint request containing a valid client_id enabled for the device workflow, grant_type="urn:ietf:params:oauth:grant-type:device_code", and an arbitrary device_code to obtain a bearer token without completing the required device authorization.
Affected software
oauthlib
How to mitigate CVE-2026-49272
Install security update from vendor's website.
oauthlib - update to 4.0.0