Oauthlib (>= 3.3.0, < 4.0.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/oauthlib--3.3.0--4.0.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 09:04:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOAuthLib: Improper device code validation in device flow (CVE-2026-49272)https://feed.craftedsignal.io/briefs/2026-10-oauthlib-device-code-bypass/Fri, 30 Oct 2026 09:04:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-oauthlib-device-code-bypass/OAuthLib fails to validate the device_code parameter during device flow token requests, allowing attackers with a valid client ID to illicitly obtain bearer tokens.OAuthLib versions 3.3.0 through 3.x are affected by an authentication bypass vulnerability in the OAuth 2.0 Device Authorization Grant implementation (RFC 8628). Specifically, the DeviceCodeGrant.validate_token_request method fails to verify the device_code parameter. An attacker possessing a valid client_id that is configured for the device workflow can submit an OAuth token request with a fabricated or arbitrary device_code value to successfully receive a bearer token. This flaw bypasses the intended device authorization handshake.

Impact

Successful exploitation allows unauthorized generation of bearer tokens for applications utilizing the affected OAuthLib version for device flow authentication, potentially leading to unauthorized access to protected resources.

Recommendation

  • Identify all internal services or products utilizing OAuthLib versions 3.3.0 through 3.x for OAuth 2.0 Device Authorization Grant workflows.
  • Upgrade affected deployments to a patched version once available from the maintainers.
  • If an immediate upgrade is not feasible, implement custom validation logic within the RequestValidator to manually verify the device_code before calling DeviceCodeGrant.validate_token_request.
  • Audit OAuth server logs for token requests using grant_type=urn:ietf:params:oauth:grant-type:device_code that lack a corresponding successful device authorization initiation.
]]>highadvisoryvulnerabilityauthentication-bypassoauth