OAuthLib Vulnerability in Device Authorization Workflow for Python
CVE-2026-49272

8.5HIGH

Key Information:

Vendor

Oauthlib

Status
Oauthlib
Vendor
CVE Published:
5 November 2026

What is CVE-2026-49272?

OAuthLib, an OAuth implementation for Python, has a security vulnerability in its RFC 8628 device workflow. Versions from 3.3.0 to 4.0.1 do not enforce validation of the device_code parameter during token request processing. This loophole allows an attacker, possessing a valid client ID, to circumvent the device authorization process by submitting an invalid or missing device code, thus gaining access to a bearer token without proper authorization. This issue has been resolved in version 4.0.1, emphasizing the importance of keeping libraries up to date for security.

Affected Version(s)

oauthlib >= 3.3.0, < 4.0.1

References

https://github.com/oauthlib/oauthlib/security/advisories/...
x_refsource_CONFIRM
https://github.com/oauthlib/oauthlib/pull/954
x_refsource_MISC
https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00d...
x_refsource_MISC

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.