{"affected":[{"product":"oauthlib","source":"CNA: GitHub_M","vendor":"oauthlib","versions":[{"status":"affected","version":"< 4.0.0"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"oauthlib","product":"oauthlib","source":"OSV GHSA-7984-qgvg-3j9c","vendor":"","versions":[{"status":"affected","version":"0.0.1","versionType":"PyPI"},{"status":"affected","version":"0.0.2","versionType":"PyPI"},{"status":"affected","version":"0.1.0","versionType":"PyPI"},{"status":"affected","version":"0.1.1","versionType":"PyPI"},{"status":"affected","version":"0.1.2","versionType":"PyPI"},{"status":"affected","version":"0.1.3","versionType":"PyPI"},{"status":"affected","version":"0.3.0","versionType":"PyPI"},{"status":"affected","version":"0.3.2","versionType":"PyPI"},{"status":"affected","version":"0.3.3","versionType":"PyPI"},{"status":"affected","version":"0.3.4","versionType":"PyPI"},{"status":"affected","version":"0.3.5","versionType":"PyPI"},{"status":"affected","version":"0.3.6","versionType":"PyPI"},{"status":"affected","version":"0.3.7","versionType":"PyPI"},{"status":"affected","version":"0.3.8","versionType":"PyPI"},{"status":"affected","version":"0.4.0","versionType":"PyPI"},{"status":"affected","version":"0.4.1","versionType":"PyPI"},{"status":"affected","version":"0.4.2","versionType":"PyPI"},{"status":"affected","version":"0.5.0","versionType":"PyPI"},{"status":"affected","version":"0.5.1","versionType":"PyPI"},{"status":"affected","version":"0.6.0","versionType":"PyPI"},{"status":"affected","version":"0.6.1","versionType":"PyPI"},{"status":"affected","version":"0.6.2","versionType":"PyPI"},{"status":"affected","version":"0.6.3","versionType":"PyPI"},{"status":"affected","version":"0.7.0","versionType":"PyPI"},{"status":"affected","version":"0.7.1","versionType":"PyPI"},{"status":"affected","version":"0.7.2","versionType":"PyPI"},{"status":"affected","version":"1.0.0","versionType":"PyPI"},{"status":"affected","version":"1.0.1","versionType":"PyPI"},{"status":"affected","version":"1.0.2","versionType":"PyPI"},{"status":"affected","version":"1.0.3","versionType":"PyPI"},{"status":"affected","version":"1.1.0","versionType":"PyPI"},{"status":"affected","version":"1.1.1","versionType":"PyPI"},{"status":"affected","version":"1.1.2","versionType":"PyPI"},{"status":"affected","version":"2.0.0","versionType":"PyPI"},{"status":"affected","version":"2.0.1","versionType":"PyPI"},{"status":"affected","version":"2.0.2","versionType":"PyPI"},{"status":"affected","version":"2.0.3","versionType":"PyPI"},{"status":"affected","version":"2.0.4","versionType":"PyPI"},{"status":"affected","version":"2.0.5","versionType":"PyPI"},{"status":"affected","version":"2.0.6","versionType":"PyPI"},{"status":"affected","version":"2.0.7","versionType":"PyPI"},{"status":"affected","version":"2.1.0","versionType":"PyPI"},{"status":"affected","version":"3.0.0","versionType":"PyPI"},{"status":"affected","version":"3.0.1","versionType":"PyPI"},{"status":"affected","version":"3.0.2","versionType":"PyPI"},{"status":"affected","version":"3.1.0","versionType":"PyPI"},{"status":"affected","version":"3.1.1","versionType":"PyPI"},{"status":"affected","version":"3.2.0","versionType":"PyPI"},{"status":"affected","version":"3.2.1","versionType":"PyPI"},{"status":"affected","version":"3.2.2","versionType":"PyPI"},{"status":"affected","version":"3.3.0","versionType":"PyPI"},{"status":"affected","version":"3.3.1","versionType":"PyPI"},{"events":[{"introduced":"0"},{"fixed":"4.0.0"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-118669","cwes":["CWE-863"],"description":"OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.","epss":{"date":"2026-11-02","percentile":0.24142,"score":0.00312},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c"}],"kev":null,"metrics":[{"score":8.4,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N","version":"4.0"}],"modifiedAt":1793713115048,"publishedAt":1793221798893,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/oauthlib/oauthlib/pull/920"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-7984-qgvg-3j9c"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-7984-qgvg-3j9c"}],"remediation":[{"kind":"fix","source":"OSV GHSA-7984-qgvg-3j9c","text":"oauthlib (PyPI): OSV reports a fixed version 4.0.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-7984-qgvg-3j9c"}],"revision":"dbac7c0f7cae4a2d380f44578fe117d9b573fcd4d2f9e3c94b38459bf7c56111","sources":[{"modifiedAt":1793713115048,"name":"CNA: GitHub_M","retrievedAt":1793714956199,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118669"},{"modifiedAt":1793402108286,"name":"OSV / GitHub Security Advisories","retrievedAt":1793714956859,"url":"https://osv.dev/vulnerability/GHSA-7984-qgvg-3j9c"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793714963692,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118669"}],"ssvc":{"assessedAt":1793713095438,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client","updatedAt":1793714963692}