CVE-2026-118669
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Prior to 4.0.0, OAuthLib's client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity, potentially issuing tokens with unauthorized grants or scopes.
Risk Assessment
The organization may issue tokens with grants or scopes a client should not have, breaking OAuth client isolation. Applications whose validators rely on the documented client_id argument are affected.
Recommendation
Upgrade OAuthLib to version 4.0.0 or later. Review grant and scope validators to ensure authorization is based on request.client rather than a client-supplied client_id.
Other vulnerabilities in OAuthLib
See all- CVE-2026-49265Medium
OAuthLib versions 3.0.0 through 4.0.0 compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in PKCE checks, potentially leaking common-prefix timing information. This could allow recovery of the code_verifier, unauthorized access-token acquisition, and account takeover, though practical exploitation requires an intercepted single-use authorization code and many measurements. The issue is fixed in version 4.0.0.
- CVE-2026-49264Medium
OAuthLib versions 0.6.1 through 4.0.0, when enable_jsonp=True, reflect an unvalidated callback request parameter into success and error response bodies in RevocationEndpoint. This allows execution of attacker-controlled JavaScript in the context of an application that loads the response as trusted JSONP, if the attacker can influence the callback. The feature is disabled by default and only affects deployments that explicitly enable JSONP. Fixed in version 4.0.0.
Original NVD description (English source)
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS