OAuthLib: Improper device code validation in device flow (CVE-2026-49272)

OAuthLib versions 3.3.0 through 3.x are affected by an authentication bypass vulnerability in the OAuth 2.0 Device Authorization Grant implementation (RFC 8628). Specifically, the DeviceCodeGrant.validate_token_request method fails to verify the device_code parameter. An attacker possessing a valid client_id that is configured for the device workflow can submit an OAuth token request with a fabricated or arbitrary device_code value to successfully receive a bearer token. This flaw bypasses the intended device authorization handshake.

Impact

Successful exploitation allows unauthorized generation of bearer tokens for applications utilizing the affected OAuthLib version for device flow authentication, potentially leading to unauthorized access to protected resources.

Recommendation

• Identify all internal services or products utilizing OAuthLib versions 3.3.0 through 3.x for OAuth 2.0 Device Authorization Grant workflows.
• Upgrade affected deployments to a patched version once available from the maintainers.
• If an immediate upgrade is not feasible, implement custom validation logic within the RequestValidator to manually verify the device_code before calling DeviceCodeGrant.validate_token_request.
• Audit OAuth server logs for token requests using grant_type=urn:ietf:params:oauth:grant-type:device_code that lack a corresponding successful device authorization initiation.