Live › vulnerability › CVE-2026-118669
Go to dashboardOAuthLib's client_credentials and password grant handlers can authenticate one client while checking grant type and scopes against an attacker-supplied client_id. A lower-privilege authenticated client can therefore obtain tokens with grants or scopes it should not have.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Applications that use OAuthLib as an OAuth 2.0 provider with client_credentials or Resource Owner Password Credentials grants, and whose validators rely on the client_id argument, are exposed. Validators that authorize only from request.client are reportedly not affected, and services that do not run an OAuthLib-based token server can skip it.
No product ranges from the sources yet.
pip show oauthlib or pip freeze | grep -i oauthlibvalidate_grant_type or validate_scopes implementation that reads request.client_id instead of request.client4.0.0 or laterrequest.client rather than request.client_idEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-118669")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.