Token Grant Handler Vulnerability in OAuthLib for Python 3.6+

CVE-2026-118669

What is CVE-2026-118669?

OAuthLib, an OAuth implementation for Python, has a vulnerability in its token grant handling mechanism. Specifically, prior to version 4.0.0, it allows the client_credentials and Resource Owner Password Credentials grant handlers to incorrectly authenticate a request.client as a confidential client while still accepting an attacker-supplied request.client_id. This misconfiguration can enable a lower-privilege authenticated client to impersonate a different client, leading to unauthorized tokens issuing with improper scopes or grants. It is crucial for application validators to ensure they rely solely on secure identifiers to prevent unauthorized access and misuse of client identities.

References