Oauthlib (>= 3.3.0, < 4.0.0)

OAuthLib fails to validate the device_code parameter during device flow token requests, allowing attackers with a valid client ID to illicitly obtain bearer tokens.