CVE-2026-49272 with a CVSS score of 8.5 is a missing validation flaw in the OAuthLib Python library's device authorization grant handling, specifically DeviceCodeGrant.validate_token_request, affecting oauthlib (pip) versions >= 3.3.0, < 4.0.0. The token endpoint accepts a request with grant type urn:ietf:params:oauth:grant-type:device_code and does not verify that the supplied device_code parameter is present or valid, contrary to the expected device workflow behavior. An attacker with network access and a valid client ID enabled for the device workflow can submit a bogus or arbitrary device_code value and receive a bearer token for that client without possessing a legitimate device code. The attack requires low privileges, no user interaction, and low complexity, while the scope change can lead to loss of confidentiality and high impact on integrity. Business impact includes unauthorized access to protected APIs or services, potential account or data compromise, and disruption of trust in OAuth-based integrations. This weakness can allow an adversary to obtain credentials that grant access to resources normally protected by the device authorization flow, increasing the risk of unauthorized operations, data exposure, and operational disruption for organizations relying on OAuth-based access control.
We recommend you to update oauthlib to version 4.0.0.[/subscribe_to_unlock_form]
CVE-2026-49272 with a CVSS score of 8.5 is a missing validation flaw in the OAuthLib Python library's device authorization grant handling, specifically DeviceCodeGrant.validate_token_request, affecting oauthlib (pip) versions >= 3.3.0, < 4.0.0. The token endpoint accepts a request with grant type urn:ietf:params:oauth:grant-type:device_code and does not verify that the supplied device_code parameter is present or valid, contrary to the expected device workflow behavior. An attacker with network access and a valid client ID enabled for the device workflow can submit a bogus or arbitrary device_code value and receive a bearer token for that client without possessing a legitimate device code. The attack requires low privileges, no user interaction, and low complexity, while the scope change can lead to loss of confidentiality and high impact on integrity. Business impact includes unauthorized access to protected APIs or services, potential account or data compromise, and disruption of trust in OAuth-based integrations. This weakness can allow an adversary to obtain credentials that grant access to resources normally protected by the device authorization flow, increasing the risk of unauthorized operations, data exposure, and operational disruption for organizations relying on OAuth-based access control.
We recommend you to update oauthlib to version 4.0.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]