{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aoauthlib_projectoauthlib/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:oauthlib_project:oauthlib:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-49272"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["oauthlib (\u003e= 3.3.0, \u003c 4.0.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","authentication-bypass","oauth"],"_cs_type":"advisory","_cs_vendors":["OAuthLib"],"content_html":"\u003cp\u003eOAuthLib versions 3.3.0 through 3.x are affected by an authentication bypass vulnerability in the OAuth 2.0 Device Authorization Grant implementation (RFC 8628). Specifically, the \u003ccode\u003eDeviceCodeGrant.validate_token_request\u003c/code\u003e method fails to verify the \u003ccode\u003edevice_code\u003c/code\u003e parameter. An attacker possessing a valid \u003ccode\u003eclient_id\u003c/code\u003e that is configured for the device workflow can submit an OAuth token request with a fabricated or arbitrary \u003ccode\u003edevice_code\u003c/code\u003e value to successfully receive a bearer token. This flaw bypasses the intended device authorization handshake.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized generation of bearer tokens for applications utilizing the affected OAuthLib version for device flow authentication, potentially leading to unauthorized access to protected resources.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all internal services or products utilizing OAuthLib versions 3.3.0 through 3.x for OAuth 2.0 Device Authorization Grant workflows.\u003c/li\u003e\n\u003cli\u003eUpgrade affected deployments to a patched version once available from the maintainers.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not feasible, implement custom validation logic within the \u003ccode\u003eRequestValidator\u003c/code\u003e to manually verify the \u003ccode\u003edevice_code\u003c/code\u003e before calling \u003ccode\u003eDeviceCodeGrant.validate_token_request\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit OAuth server logs for token requests using \u003ccode\u003egrant_type=urn:ietf:params:oauth:grant-type:device_code\u003c/code\u003e that lack a corresponding successful device authorization initiation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T09:04:51Z","date_published":"2026-10-30T09:04:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-oauthlib-device-code-bypass/","summary":"OAuthLib fails to validate the device_code parameter during device flow token requests, allowing attackers with a valid client ID to illicitly obtain bearer tokens.","title":"OAuthLib: Improper device code validation in device flow (CVE-2026-49272)","url":"https://feed.craftedsignal.io/briefs/2026-10-oauthlib-device-code-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:oauthlib_project:oauthlib:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}