CVE-2026-49272

    Dashboard / Vulnerabilities / CVE-2026-49272

    CVE-2026-49272

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

    Details: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validate_token_request to check that the device_code parameter is present and valid. A caller whose client request is accepted by the configured validator and who knows a valid client ID enabled for the device workflow can submit a missing or bogus device code to the token endpoint and obtain a bearer token without completing device authorization. This issue is fixed in version 4.0.1.

    References: https://github.com/oauthlib/oauthlib/releases/tag/v4.0.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49272.json, https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc, https://nvd.nist.gov/vuln/detail/CVE-2026-49272, https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114, https://github.com/oauthlib/oauthlib/pull/954

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6413d2e2a6414cdf29414b975f939c99f8046d59
    Fixed -6e3aa05af92978755939a18cb4dd655ced156c1e

    Affected versions

    v4.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-49272 | CVE-DB