{"affected":[{"product":"oauthlib","source":"CNA: GitHub_M","vendor":"oauthlib","versions":[{"status":"affected","version":">= 3.3.0, < 4.0.1"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"oauthlib","product":"oauthlib","source":"OSV GHSA-3jp2-3mrg-2vxc","vendor":"","versions":[{"status":"affected","version":"3.3.0","versionType":"PyPI"},{"status":"affected","version":"3.3.1","versionType":"PyPI"},{"events":[{"introduced":"3.3.0"},{"fixed":"4.0.0"}],"status":"unknown","version":"3.3.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-49272","cwes":["CWE-287"],"description":"OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validate_token_request to check that the device_code parameter is present and valid. A caller whose client request is accepted by the configured validator and who knows a valid client ID enabled for the device workflow can submit a missing or bogus device code to the token endpoint and obtain a bearer token without completing device authorization. This issue is fixed in version 4.0.1.","epss":null,"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc"}],"kev":null,"metrics":[{"score":8.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","version":"3.1"}],"modifiedAt":1793913283982,"publishedAt":1793912280517,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/oauthlib/oauthlib/pull/954"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/oauthlib/oauthlib/releases/tag/v4.0.1"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-3jp2-3mrg-2vxc"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-3jp2-3mrg-2vxc"}],"remediation":[{"kind":"fix","source":"OSV GHSA-3jp2-3mrg-2vxc","text":"oauthlib (PyPI): OSV reports a fixed version 4.0.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-3jp2-3mrg-2vxc"}],"revision":"c388533fae7ff426d1b6aec83cca7087b043e5cd735b5c282dc9bba95f03ebd2","sources":[{"modifiedAt":1793913283982,"name":"CNA: GitHub_M","retrievedAt":1793913842218,"url":"https://www.cve.org/CVERecord?id=CVE-2026-49272"},{"modifiedAt":1793108703096,"name":"OSV / GitHub Security Advisories","retrievedAt":1793913843072,"url":"https://osv.dev/vulnerability/GHSA-3jp2-3mrg-2vxc"}],"ssvc":{"assessedAt":1793913268774,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow","updatedAt":1793913843072}